malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

This is the 4.14.354 OpenELA-Extended LTS stable release

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEERFwmR4yFob14UDOYC8702P6YulgFAmcgko0ZHHZlZ2FyZC5u
 b3NzdW1Ab3JhY2xlLmNvbQAKCRALzvTY/pi6WL/GD/0em+uP/O8QiPYqeGrEECpW
 bgRsBiN3XnyEsghAjplWX12G/zjxA0PY0u2zh9K9sdPw60n8nVZ1OxvPHINwuSC9
 kE9N60SCpJ88ju9OtU+4xz/nxtEmlel8fWy5elagB5wqbWbvsjT52ceZXqSxqhy7
 pQdIDHSiUUwx9JL6vDuJSL+Z/Y216qvBETZLnDSo90raFp/MDa5JmQsh81lLeUt8
 wGKwC/Olnbd21QTStNK34aQGyX5b+3YeACFVPud66Zs9airz9EE6Yq78gwL29L2k
 4jxzihXxSkkfa66eR63ap53+/mEqOZX72m2qEMVOvAcAwU0XsNDTdkXN7z8YQ5T3
 E1rJwr4Ox0hmM+hHBA20w9xRDXZoZmdrcjsU1aNKuK2zTJ0h9DBIvMM2XY5n5sWK
 I4F8E15KyKmu4nXBETreXZixqVLZMgjNFncRLf8XBIL1kxXm65LYCHypp3AgdVgo
 Ccdq5PbC6LAyNPrIOaftIaS9VlU15cqcalu7A+gSoWq55LGWAa3G9vX0ZtYQB9QX
 0R18fbzyjqG6Wa5J5KRDJ+HyS4IvdnEWS8hMR3jfosjMNgJhfDlDeev8NARBiDpX
 d26xogNA7xOOvtdpuwEbnxD5kR0zUdnC73pC4wxdMptYSK6ULKNPmTkA0dKE9qvl
 TDgw4DML8vXQqJ4P+w3Njw==
 =gX2R
 -----END PGP SIGNATURE-----

Merge tag 'v4.14.354-openela' of https://github.com/openela/kernel-lts

This is the 4.14.354 OpenELA-Extended LTS stable release

* tag 'v4.14.354-openela' of https://github.com/openela/kernel-lts: (90 commits)
  LTS: Update to 4.14.354
  drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var
  ipc: remove memcg accounting for sops objects in do_semtimedop()
  scsi: aacraid: Fix double-free on probe failure
  usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
  usb: dwc3: st: fix probed platform device ref count on probe error path
  usb: dwc3: core: Prevent USB core invalid event buffer address access
  usb: dwc3: omap: add missing depopulate in probe error path
  USB: serial: option: add MeiG Smart SRM825L
  cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
  net: busy-poll: use ktime_get_ns() instead of local_clock()
  gtp: fix a potential NULL pointer dereference
  net: prevent mss overflow in skb_segment()
  ida: Fix crash in ida_free when the bitmap is empty
  net:rds: Fix possible deadlock in rds_message_put
  fbmem: Check virtual screen sizes in fb_set_var()
  fbcon: Prevent that screen size is smaller than font size
  printk: Export is_console_locked
  memcg: enable accounting of ipc resources
  cgroup/cpuset: Prevent UAF in proc_cpuset_show()
  ...

Change-Id: I7da4d8d188dec9d2833216e5d6580dbd72b99240
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
This commit is contained in:
Richard Raya 2024-10-29 20:14:12 -03:00
commit 2cd059fb56
90 changed files with 1399 additions and 272 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.elts/config.yaml
View File

@ -1,5 +1,5 @@
upstream_repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
upstream_base: 4.19.304
base: 4.14.336
upstream_version: 4.19.320
version: 4.14.353
upstream_version: 4.19.321
version: 4.14.354

348
.elts/meta/4.14.354.yaml Normal file
View File

@ -0,0 +1,348 @@
fcb5aec66ce07e8329a51583b152150aa659236a:
title: 'fuse: Initialize beyond-EOF page contents before setting uptodate'
mainline: 3c0da3d163eb32f1f91891efaade027fa9b245b9
upstream: 49934861514d36d0995be8e81bb3312a499d8d9a
3d810347c95892c8f2ad7524a9dfac7643a838d2:
title: 'ALSA: usb-audio: Support Yamaha P-125 quirk entry'
mainline: c286f204ce6ba7b48e3dcba53eda7df8eaa64dd9
upstream: 05c60b306979935e5e4f2339a0ceece783893813
ceb3e3f9e1dc2aabfbe3ad010e400a085270ea3b:
title: 'dm resume: don''t return EINVAL when signalled'
mainline: 7a636b4f03af9d541205f69e373672e7b2b60a8a
upstream: a809f6d8b10ce6d42e205a49c8855def77e1d452
058be20653b9ce45b758e8e9f41c91f4fd51eebc:
title: 'dm persistent data: fix memory allocation failure'
mainline: faada2174c08662ae98b439c69efe3e79382c538
upstream: 90a6b797e95d0f4bef30fbab423759f4e9999506
90707a9e8cb97a896468af8280e33c377c001ed2:
title: 'include/linux/bitmap.h: make bitmap_fill() and bitmap_zero() consistent'
e12d520dc158be6dc4177147186a5ae53ebc2aaa:
title: 'selinux: fix potential counting error in avc_add_xperms_decision()'
mainline: 379d9af3f3da2da1bbfa67baf1820c72a080d1f1
upstream: 5d93f05ed258c92a8925b74bc36101af36c22732
854d4d53234aa5ebf5ec8dc947cb5a8e3288bf9d:
title: 'drm/amdgpu: Actually check flags for all context ops.'
mainline: 0573a1e2ea7e35bff08944a40f1adf2bb35cea61
upstream: c5e2c86aef97d4b17ccb52879ab524a36a93566d
6f2b82ee5ceb2de5411a2742b352030f08ae183b:
title: 'memcg_write_event_control(): fix a user-triggerable oops'
mainline: 046667c4d3196938e992fba0dfcde570aa85cd0e
upstream: fa5bfdf6cb5846a00e712d630a43e3cf55ccb411
0671b47894f55a65eee7907574ae9a4e6a681be8:
title: 's390/cio: rename bitmap_size() -> idset_bitmap_size()'
mainline: c1023f5634b9bfcbfff0dc200245309e3cde9b54
upstream: 537201a9c9d82d3809de8e692465671b98d7cf77
ebb9622683941bdd58ebee5b744d9dd27d2cbe92:
title: 'overflow.h: Add flex_array_size() helper'
mainline: b19d57d0f3cc6f1022edf94daf1d70506a09e3c2
upstream: 81bec94f5d864318fa4fccfd06e5449c501885b7
c698c6c7ce9f267ce483b4276c10daedfae14295:
title: 'overflow: Implement size_t saturating arithmetic helpers'
mainline: e1be43d9b5d0d1310dbd90185a8e5c7145dde40f
upstream: 1f5cbd78177975aece64bb132948f611af2359c0
5e78e68997f6e81f5ea7b7d7adcb0299f6cbe0eb:
title: 'btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()'
mainline: 4ca532d64648d4776d15512caed3efea05ca7195
upstream: eeca0881c04b07e053cd24b455012b6abd164328
9c791f3833511ef47bd93f0069b3f216dc800843:
title: 'atm: idt77252: prevent use after free in dequeue_rx()'
mainline: a9a18e8f770c9b0703dab93580d0b02e199a4c79
upstream: 628ea82190a678a56d2ec38cda3addf3b3a6248d
cb51898f8eec5dd8524115da29d9414c6a117f67:
title: 'ssb: Fix division by zero issue in ssb_calc_clock_rate'
mainline: e0b5127fa134fe0284d58877b6b3133939c8b3ce
upstream: b0862789cc11a214d31b6ff9c74bfede90dfb68d
f4d17cd8acb0d59a0c6e16c00d411e4047ce4af9:
title: 'wifi: cw1200: Avoid processing an invalid TIM IE'
mainline: b7bcea9c27b3d87b54075735c870500123582145
upstream: 2d109cefa3a51a6d826914f441a40d9efb1143b6
f22c4b1e57a22b1e5b6a0754286c8136ed290c14:
title: 'staging: ks7010: disable bh on tx_dev_lock'
mainline: 058cbee52ccd7be77e373d31a4f14670cfd32018
upstream: 936a24249747e0d995fc2d66524b043a3d158705
0f4437492406977e2f14c77e67956facd888765d:
title: 'binfmt_misc: cleanup on filesystem umount'
mainline: 1c5976ef0f7ad76319df748ccb99a4c7ba2ba464
upstream: 263bcebf5c2ab1fe949517225157f34015124620
5e532c67718aa680857ff1bf76bf470f93dbf92d:
title: 'scsi: spi: Fix sshdr use'
mainline: 0b149cee836aa53989ea089af1cb9d90d7c6ac9e
upstream: 5fe4af45db7988a0df3533d45aba085771654811
431cbbd124292f497b4862a88ac60015765adb49:
title: 'gfs2: setattr_chown: Add missing initialization'
mainline: 2d8d7990619878a848b1d916c2f936d3012ee17d
upstream: 686ef69ca191dcba8d325334c65a04a2589383e6
e0961317d13c9d29d8901ab4053bf102b9595b6e:
title: 'wifi: iwlwifi: abort scan when rfkill on but device enabled'
mainline: 3c6a0b1f0add72e7f522bc9145222b86d0a7712a
upstream: 6b344eb86f3b47e18d8fc2b0ae3e8e927f098994
4297287b1132064e10b140991aa9d465d1926c24:
title: 'powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu'
mainline: 45b1ba7e5d1f6881050d558baf9bc74a2ae13930
upstream: 479a0cffcca7e3672a7db5f9e23b147fb6cfba39
0c2fd9f775685c502a30310255f91b826b979cbf:
title: 'ext4: do not trim the group with corrupted block bitmap'
mainline: 172202152a125955367393956acf5f4ffd092e0d
upstream: cac7c9fcd15e92184c8e621b1f33d97d99505366
df321d5b02416398d284e7af74bf4dfce4879e83:
title: 'quota: Remove BUG_ON from dqget()'
mainline: 249f374eb9b6b969c64212dd860cc1439674c4a8
upstream: c08d02053b9e98dffea9b9b378dc90547e4621e8
4e2660eb12ff478bc6604d3b6d34d5052a2e5a3e:
title: 'media: pci: cx23885: check cx23885_vdev_init() return'
mainline: 15126b916e39b0cb67026b0af3c014bfeb1f76b3
upstream: 8e31b096e2e1949bc8f0be019c9ae70d414404c6
eba1af4c431230bd41b1018f1000f95e02f2ef92:
title: 'fs: binfmt_elf_efpic: don''t use missing interpreter''s properties'
mainline: 15fd1dc3dadb4268207fa6797e753541aca09a2a
upstream: 8ca5b21fa9b2c13aad93a97992b92f9360988fe9
7cb20343fea9c616687a8ba6feb41a543f94e57e:
title: 'scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()'
mainline: 3d0f9342ae200aa1ddc4d6e7a573c6f8f068d994
upstream: 50568ec1402e601125845835c326310031c65c81
8ab663cd2711e234d222565fc86632a09319263a:
title: 'net/sun3_82586: Avoid reading past buffer in debug output'
mainline: 4bea747f3fbec33c16d369b2f51e55981d7c78d0
upstream: 7783533f788e59691102bae6e2df03f2109624de
7ce64ccc2ff813b5cccd19298f889c464cab3f4d:
title: 'md: clean up invalid BUG_ON in md_ioctl'
mainline: 9dd8702e7cd28ebf076ff838933f29cf671165ec
upstream: 5c11581df1f58c43ce8b2e9c14184ab1f75c883f
172e698211ff81d1c66161b4591efc8c21c350dc:
title: 'parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367'
mainline: 73cb4a2d8d7e0259f94046116727084f21e4599f
upstream: fea29d479eb470102cd025d9279503a2bfd28c60
d8893f4de9af18d7878cef063d94387d122e9901:
title: 'powerpc/boot: Handle allocation failure in simple_realloc()'
mainline: 69b0194ccec033c208b071e019032c1919c2822d
upstream: cd146e31691187ec22b404a2771db199d370d59d
8d63c5821851b1b13fe34eb0d41189cc05b498a9:
title: 'powerpc/boot: Only free if realloc() succeeds'
mainline: f2d5bccaca3e8c09c9b9c8485375f7bdbb2631d2
upstream: 1180feef209487d2a95ba8fede71ec6add2e8e52
b52a80ebbf8e6be987ee8e40a7a1d7e550cafe3f:
title: 'btrfs: change BUG_ON to assertion when checking for delayed_node root'
mainline: be73f4448b607e6b7ce41cd8ef2214fdf6e7986f
upstream: be9ce497c7cb293f93cf98ef563b6456bac75686
4ae1ece59eff262456026a20164702f8ecfa2875:
title: 'btrfs: handle invalid root reference found in may_destroy_subvol()'
mainline: 6fbc6f4ac1f4907da4fc674251527e7dc79ffbf6
upstream: ebce7d482d1a08392362ddf936ffdd9244fb1ece
b1410389811d63127bd09bd1f21adba03e686b23:
title: 'btrfs: send: handle unexpected data in header buffer in begin_cmd()'
mainline: e80e3f732cf53c64b0d811e1581470d67f6c3228
upstream: f0b54836bf2ff59b866a6db481f9ad46fa30b642
0a7ed5945f5b2fb92877188e2ebc78067937f7cc:
title: 'btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()'
mainline: f40a3ea94881f668084f68f6b9931486b1606db0
upstream: 5ae1493c5eac1a7a7ced34970a24cb3a5680a63b
00705650825973da3c2fceae82def9e4eda121e4:
title: 'f2fs: fix to do sanity check in update_sit_entry'
mainline: 36959d18c3cf09b3c12157c6950e18652067de77
upstream: 3c2c864f19490da6e892290441ba7dcc7bae2576
7bc6f5f8bbb72993c108fa3f26283bd9c1406cc0:
title: 'usb: gadget: fsl: Increase size of name buffer for endpoints'
mainline: 87850f6cc20911e35eafcbc1d56b0d649ae9162d
upstream: 29d8f0e05a33200db97d4b38c995c843a70f71e5
4eb6b4890ed3c23303144f9a5cd341b7b22a1612:
title: 'Bluetooth: bnep: Fix out-of-bound access'
mainline: 0f0639b4d6f649338ce29c62da3ec0787fa08cd1
upstream: 01ed379cb5ddc0049a348786b971fe53a31e6255
cfe972295c3312e0a91aa910d94770ecd44179ac:
title: 'NFS: avoid infinite loop in pnfs_update_layout.'
mainline: 2fdbc20036acda9e5694db74a032d3c605323005
upstream: 4980d45cca2b1135a1ab3dea101425cf44da72cd
ca6e68d71ece21decaa46ff8b3694570e712b738:
title: 'openrisc: Call setup_memory() earlier in the init sequence'
mainline: 7b432bf376c9c198a7ff48f1ed14a14c0ffbe1fe
upstream: 3979298b8033989f86d74ab47745e5fbe84a4ebb
4832811162db2d2312cb89ee37849338312e6590:
title: 's390/iucv: fix receive buffer virtual vs physical address confusion'
mainline: 4e8477aeb46dfe74e829c06ea588dd00ba20c8cc
upstream: da6cc71ff6c8e6b5076e80550b4e79a3d8f111be
a4dc7b3a5f855afff980b9dcb0e2ceb24f7868d2:
title: 'usb: dwc3: core: Skip setting event buffers for host only controllers'
mainline: 89d7f962994604a3e3d480832788d06179abefc5
upstream: 320bb9a5a6b79ba123d1e1f746edb52b41c7c1fb
2236d13af575a3658cee60e8db880740509d5b66:
title: 'irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc'
mainline: 382d2ffe86efb1e2fa803d2cf17e5bfc34e574f3
upstream: 139510ec274c7cc8739bb8f63aed70e425c2f0d8
90ef0457118eaeab238228f223059b1f93389d73:
title: 'ext4: set the type of max_zeroout to unsigned int to avoid overflow'
mainline: 261341a932d9244cbcd372a3659428c8723e5a49
upstream: 2f64ae32831e5a2bfd0e404c6e63b399eb180a0a
2e31c2b032e1c2868c06b57b319907c83004eddc:
title: 'nvmet-rdma: fix possible bad dereference when freeing rsps'
mainline: 73964c1d07c054376f1b32a62548571795159148
upstream: 66fce1c83e2def702dd6a7fb77e986c062b20972
b02d82c6edb6abc9c87d281af2b3050e618f2fa1:
title: 'hrtimer: Prevent queuing of hrtimer without a function callback'
mainline: 5a830bbce3af16833fe0092dec47b6dd30279825
upstream: ccef3adcb84816a30b8e535c8c4fcb167904e7b1
8e448b4536e8b8cc387052bdb058ca595627bf1f:
title: 'gtp: pull network headers in gtp_dev_xmit()'
mainline: 3a3be7ff9224f424e485287b54be00d2c6bd9c40
upstream: 3d89d0c4a1c6d4d2a755e826351b0a101dbc86f3
30a1325eab21676ba9c453de44e70fe598a6b8e0:
title: 'block: use "unsigned long" for blk_validate_block_size().'
mainline: 37ae5a0f5287a52cf51242e76ccf198d02ffe495
upstream: ee12aa483f6c8cecbd5a4c794867fee0e068b822
52e5665bbc50c235e1498d2f40d1004c817a7895:
title: 'Bluetooth: Make use of __check_timeout on hci_sched_le'
mainline: 1b1d29e5149990e44634b2e681de71effd463591
upstream: 67cddb2a1b256941952ebf501f8fc4936b704c8b
874a31d69b75d57b7e017d7418a5e4ab4e537dc0:
title: 'Bluetooth: hci_core: Fix not handling link timeouts propertly'
mainline: 116523c8fac05d1d26f748fee7919a4ec5df67ea
upstream: edb7dbcf8c1e95dc18ada839526ff86df3258d11
ac7a5e553fe290082863eac89a4c79ec941a947c:
title: 'Bluetooth: hci_core: Fix LE quote calculation'
mainline: 932021a11805b9da4bd6abf66fe233cccd59fe0e
upstream: 08829a8ff1303b1a903d1417dc0a06ffc7d17044
6bff278ca0373109466e5e16c2b5b7feb2d275cc:
title: 'kcm: Serialise kcm_sendmsg() for the same socket.'
mainline: 807067bf014d4a3ae2cc55bd3de16f22a01eb580
upstream: 8c9cdbf600143bd6835c8b8351e5ac956da79aec
7308cdf114aa3e10b931d967f9c6224bea4da005:
title: 'netfilter: nft_counter: Synchronize nft_counter_reset() against reader.'
mainline: a0b39e2dc7017ac667b70bdeee5293e410fab2fb
upstream: 31c28919a99f5c491e3cce4fa7293b12e330e247
9011fa8f8e5bc75aa260d56c3c0f6fbfbd4f55d1:
title: 'ipv6: prevent UAF in ip6_send_skb()'
mainline: faa389b2fbaaec7fd27a390b4896139f9da662e3
upstream: 571567e0277008459750f0728f246086b2659429
019fc01257a13f075f7bd93a6fa8e02d822dacbd:
title: 'net: xilinx: axienet: Always disable promiscuous mode'
mainline: 4ae738dfef2c0323752ab81786e2d298c9939321
upstream: e15ae5f903e1e54594a55146973d1e615519ae97
a2b9cfe9687c3389a4cbc8b8e665baad4ef6087f:
title: 'mmc: mmc_test: Fix NULL dereference on allocation failure'
mainline: a1e627af32ed60713941cbfc8075d44cad07f6dd
upstream: e97be13a9f51284da450dd2a592e3fa87b49cdc9
ff165baf4bce33ecf7d628676ff606401ceb317f:
title: 'Bluetooth: MGMT: Add error handling to pair_device()'
mainline: 538fd3921afac97158d4177139a0ad39f056dbb2
upstream: 11b4b0e63f2621b33b2e107407a7d67a65994ca1
0ab5b59ccee3b6a0b46021458d60a8a7d3497bcc:
title: 'HID: wacom: Defer calculation of resolution until resolution_code is known'
mainline: 1b8f9c1fb464968a5b18d3acc1da8c00bad24fad
upstream: 10ddadfab0272f37c9c73095c089970e65b38824
9d1b2b527ab3dd13c18c3460b50f474ede01cacf:
title: 'mmc: dw_mmc: allow biu and ciu clocks to defer'
mainline: 6275c7bc8dd07644ea8142a1773d826800f0f3f7
upstream: 714ac96c0d6e594b50d89d79e07ae76d22040b73
408390db2ed1d018b5f958bec4dc86cf1d27fe77:
title: 'ALSA: timer: Relax start tick time check for slave timer elements'
mainline: ccbfcac05866ebe6eb3bc6d07b51d4ed4fcde436
upstream: bfe0ba951567d9e4a2c60424d12067000ee27158
2ec8267b2741c4c576ec568dbfb4802d2880345f:
title: 'Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO'
mainline: 9c33663af9ad115f90c076a1828129a3fbadea98
upstream: aea24ef5e9b2bbc5d5d05e39b10573971b91241c
f0ca8ebc5b58f920ed33dd6bd7d7e515744eb362:
title: 'Input: MT - limit max slots'
mainline: 99d3bf5f7377d42f8be60a6b9cb60fb0be34dceb
upstream: 2829c80614890624456337e47320289112785f3e
c3429e72b0b782a2bbaafb19d69018b65d0bd26f:
title: 'drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc'
mainline: 88a9a467c548d0b3c7761b4fd54a68e70f9c0944
upstream: d35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8
88f275a1e9972573add8003dc920818f17e8750a:
title: 'pinctrl: single: fix potential NULL dereference in pcs_get_function()'
mainline: 1c38a62f15e595346a1106025722869e87ffe044
upstream: 0a2bab5ed161318f57134716accba0a30f3af191
202eaab237a3cc7da4b688a77234744f62f31ccf:
title: 'wifi: mwifiex: duplicate static structs used in driver instances'
mainline: 27ec3c57fcadb43c79ed05b2ea31bc18c72d798a
upstream: 42a15750b777edcb9be4eeea16ea04c0c4869cdc
17fc0471635d9dca0781f8c90dbbd4161950b9fc:
title: 'dm suspend: return -ERESTARTSYS instead of -EINTR'
mainline: 1e1fd567d32fcf7544c6e09e0e5bc6c650da6e23
upstream: ac7f3b1e424f2f38e81d27d7e1ecb30dcd9dd651
2df5bdcc5b24b465d66f322073a523ba9ed852f3:
title: 'scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES'
mainline: 82dbb57ac8d06dfe8227ba9ab11a49de2b475ae5
upstream: 868e60c28c2e838a005b41d2f69e923a07080a48
3ae8e605510b7e72f71d9537919b3d83f01d5e07:
title: 'filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64'
63dc7ea2f1a4d9560772db5ce062b11574c6a7b0:
title: 'media: uvcvideo: Use ktime_t for timestamps'
16913ef7e6317548e59036f4ee331d6f2f7f8913:
title: 'media: uvcvideo: Fix integer overflow calculating timestamp'
mainline: 8676a5e796fa18f55897ca36a94b2adf7f73ebd1
upstream: 34666cab862a8154013713aaee0cc5da1241dd75
4284ad6ee12894faa3fdfcc584a32aa4ce2a4fbc:
title: 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()'
mainline: 1be59c97c83ccd67a519d8a49486b3a8a73ca28a
upstream: 27d6dbdc6485d68075a0ebf8544d6425c1ed84bb
f477af54dbe386b3ab323b5b765910e0e7851180:
title: 'memcg: enable accounting of ipc resources'
mainline: 18319498fdd4cdf8c1c2c48cd432863b1f915d6f
upstream: 9e235ce6facfef2cbde3e2a5f1ccce28d341880f
38d216ce7ac318b8dfaef24bb378c51c7a1aa151:
title: 'printk: Export is_console_locked'
cb4213b43b1c11a9c6a01ab412a48a78f372ec69:
title: 'fbcon: Prevent that screen size is smaller than font size'
mainline: e64242caef18b4a5840b0e7a9bff37abd4f4f933
upstream: 54eaaac622d4547b4abae7e44763b29fa0687132
fc15b7d69dd3b6418c8de3a3ff52a2d380d76d92:
title: 'fbmem: Check virtual screen sizes in fb_set_var()'
mainline: 6c11df58fd1ac0aefcb3b227f72769272b939e56
upstream: f453f32f13320137f2317c0ad7ae1c20508effca
ae877b9999278eedaf73d6e0e2797d3ed613d802:
title: 'net:rds: Fix possible deadlock in rds_message_put'
mainline: f1acf1ac84d2ae97b7889b87223c1064df850069
upstream: 6a967835748472229da405bdb7780f98084c6ebc
2cd2e32fc40226fe651a178ec13c343b18a58ba5:
title: 'ida: Fix crash in ida_free when the bitmap is empty'
mainline: af73483f4e8b6f5c68c9aa63257bdd929a9c194a
upstream: 89db5346acb5a15e670c4fb3b8f3c30fa30ebc15
b9b5914ae919e100f936acf89c40564438eea7ca:
title: 'net: prevent mss overflow in skb_segment()'
mainline: 23d05d563b7e7b0314e65c8e882bc27eac2da8e7
upstream: 0d3ffbbf8631d6db0552f46250015648991c856f
05748e7d5793a9b4006096221f8c991a7eaf3849:
title: 'gtp: fix a potential NULL pointer dereference'
mainline: defd8b3c37b0f9cb3e0f60f47d3d78d459d57fda
upstream: 620fe9809752fae91b4190e897b81ed9976dfb39
843fa098a51e412907dcd804d8e7cc3c28945edd:
title: 'net: busy-poll: use ktime_get_ns() instead of local_clock()'
mainline: 0870b0d8b393dde53106678a1e2cec9dfa52f9b7
upstream: 1b1f0890fb51fc50bf990a800106a133f9036f32
0089d92552aa7a94e2edb2441fe9017e20c4f63d:
title: 'cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller'
mainline: 0b00583ecacb0b51712a5ecd34cf7e6684307c67
upstream: 43f8d47eaa36c16eb0beafdedbfba51220b4fe69
f44a24bcd5833a5b5d32a0bab95bed37a86cbf55:
title: 'USB: serial: option: add MeiG Smart SRM825L'
mainline: 9a471de516c35219d1722c13367191ce1f120fe9
upstream: 50f98b68051d01216bd59df5d0673d7a442d17cd
c180e1013eb6b4db7ddf220491a2e325b7fcf06e:
title: 'usb: dwc3: omap: add missing depopulate in probe error path'
mainline: 2aa765a43817ec8add990f83c8e54a9a5d87aa9c
upstream: 9c80a94d388528add073955108a1eeeed4c1c5ea
347ecd5288aaff7fcc0828d8e2bbd122cce42a43:
title: 'usb: dwc3: core: Prevent USB core invalid event buffer address access'
mainline: 14e497183df28c006603cc67fd3797a537eef7b9
upstream: eca3f543f817da87c00d1a5697b473efb548204f
f86e58bf1c74fcdfcfb78baecf156127409442be:
title: 'usb: dwc3: st: fix probed platform device ref count on probe error path'
mainline: ddfcfeba891064b88bb844208b43bef2ef970f0c
upstream: b0979a885b9d4df2a25b88e9d444ccaa5f9f495c
2a00c7c9045d6b359ab6b51e71ab4be6f4dac461:
title: 'usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()'
mainline: 3a8839bbb86da7968a792123ed2296d063871a52
upstream: 0e9d60d0da23b5c344aaad9cb2088684f8548f9f
caebf7249fb7bd0cb68e7b6f8a88f033d82ac221:
title: 'scsi: aacraid: Fix double-free on probe failure'
mainline: 919ddf8336f0b84c0453bac583808c9f165a85c2
upstream: d237c7d06ffddcdb5d36948c527dc01284388218
30eb6ce857111743822a317414a1f183319a105a:
title: 'ipc: remove memcg accounting for sops objects in do_semtimedop()'
mainline: 6a4746ba06191e23d30230738e94334b26590a8a
upstream: 72793f5cc9e41f9ee33353d4594036817529b766
6c3aa8fda82fedf05e697ef8c57d92c3b9d838b8:
title: 'drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var'
mainline: 1935f0deb6116dd785ea64d8035eab0ff441255b
upstream: 0975670c14287183571d01858e8020114a14d76a

394
.elts/upstream/4.19.321.yaml Normal file
View File

@ -0,0 +1,394 @@
49934861514d36d0995be8e81bb3312a499d8d9a:
title: 'fuse: Initialize beyond-EOF page contents before setting uptodate'
mainline: 3c0da3d163eb32f1f91891efaade027fa9b245b9
backport: fcb5aec66ce07e8329a51583b152150aa659236a
05c60b306979935e5e4f2339a0ceece783893813:
title: 'ALSA: usb-audio: Support Yamaha P-125 quirk entry'
mainline: c286f204ce6ba7b48e3dcba53eda7df8eaa64dd9
backport: 3d810347c95892c8f2ad7524a9dfac7643a838d2
ef0a0e616b2789bb804a0ce5e161db03170a85b6:
title: 'xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration'
mainline: af8e119f52e9c13e556be9e03f27957554a84656
skipped: fixes patch not in branch
2fbc3c6736cb0a1c2738664bf9381d0c96fb7a06:
title: 'arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE'
mainline: a21dcf0ea8566ebbe011c79d6ed08cdfea771de3
skipped: fixes patch not in branch
a809f6d8b10ce6d42e205a49c8855def77e1d452:
title: 'dm resume: don''t return EINVAL when signalled'
mainline: 7a636b4f03af9d541205f69e373672e7b2b60a8a
backport: ceb3e3f9e1dc2aabfbe3ad010e400a085270ea3b
90a6b797e95d0f4bef30fbab423759f4e9999506:
title: 'dm persistent data: fix memory allocation failure'
mainline: faada2174c08662ae98b439c69efe3e79382c538
backport: 058be20653b9ce45b758e8e9f41c91f4fd51eebc
188729977a0cfac6e04a59bf75f85ccd19ad4b4d:
title: 'bitmap: introduce generic optimized bitmap_size()'
mainline: a37fbe666c016fd89e4460d0ebfcea05baba46dc
skipped: commit did not cherry-pick cleanly
ee501f827f3db02d4e599afbbc1a7f8b792d05d7:
title: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
mainline: 9a2fa1472083580b6c66bdaf291f591e1170123a
skipped: commit did not cherry-pick cleanly
5d93f05ed258c92a8925b74bc36101af36c22732:
title: 'selinux: fix potential counting error in avc_add_xperms_decision()'
mainline: 379d9af3f3da2da1bbfa67baf1820c72a080d1f1
backport: e12d520dc158be6dc4177147186a5ae53ebc2aaa
c5e2c86aef97d4b17ccb52879ab524a36a93566d:
title: 'drm/amdgpu: Actually check flags for all context ops.'
mainline: 0573a1e2ea7e35bff08944a40f1adf2bb35cea61
backport: 854d4d53234aa5ebf5ec8dc947cb5a8e3288bf9d
fa5bfdf6cb5846a00e712d630a43e3cf55ccb411:
title: 'memcg_write_event_control(): fix a user-triggerable oops'
mainline: 046667c4d3196938e992fba0dfcde570aa85cd0e
backport: 6f2b82ee5ceb2de5411a2742b352030f08ae183b
537201a9c9d82d3809de8e692465671b98d7cf77:
title: 's390/cio: rename bitmap_size() -> idset_bitmap_size()'
mainline: c1023f5634b9bfcbfff0dc200245309e3cde9b54
backport: 0671b47894f55a65eee7907574ae9a4e6a681be8
81bec94f5d864318fa4fccfd06e5449c501885b7:
title: 'overflow.h: Add flex_array_size() helper'
mainline: b19d57d0f3cc6f1022edf94daf1d70506a09e3c2
backport: ebb9622683941bdd58ebee5b744d9dd27d2cbe92
1f5cbd78177975aece64bb132948f611af2359c0:
title: 'overflow: Implement size_t saturating arithmetic helpers'
mainline: e1be43d9b5d0d1310dbd90185a8e5c7145dde40f
backport: c698c6c7ce9f267ce483b4276c10daedfae14295
eeca0881c04b07e053cd24b455012b6abd164328:
title: 'btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()'
mainline: 4ca532d64648d4776d15512caed3efea05ca7195
backport: 5e78e68997f6e81f5ea7b7d7adcb0299f6cbe0eb
fe8dfead9acd674715c993094280f0b3990ff359:
title: 'net/mlx5e: Correctly report errors for ethtool rx flows'
mainline: cbc796be1779c4dbc9a482c7233995e2a8b6bfb3
skipped: fixes patch not in branch
628ea82190a678a56d2ec38cda3addf3b3a6248d:
title: 'atm: idt77252: prevent use after free in dequeue_rx()'
mainline: a9a18e8f770c9b0703dab93580d0b02e199a4c79
backport: 9c791f3833511ef47bd93f0069b3f216dc800843
bf845a2bcc6c8e373108b8fa940bfa9aac3ff9dd:
title: 'net: dsa: vsc73xx: pass value in phy_write operation'
mainline: 5b9eebc2c7a5f0cc7950d918c1e8a4ad4bed5010
skipped: fixes patch not in branch
b0862789cc11a214d31b6ff9c74bfede90dfb68d:
title: 'ssb: Fix division by zero issue in ssb_calc_clock_rate'
mainline: e0b5127fa134fe0284d58877b6b3133939c8b3ce
backport: cb51898f8eec5dd8524115da29d9414c6a117f67
2d109cefa3a51a6d826914f441a40d9efb1143b6:
title: 'wifi: cw1200: Avoid processing an invalid TIM IE'
mainline: b7bcea9c27b3d87b54075735c870500123582145
backport: f4d17cd8acb0d59a0c6e16c00d411e4047ce4af9
ce13105a492c91dce263198708b86773569ce370:
title: 'i2c: riic: avoid potential division by zero'
mainline: 7890fce6201aed46d3576e3d641f9ee5c1f0e16f
skipped: fixes non-present commit d982d66514192cdbe74eababa63d0a69be4b0ce1
936a24249747e0d995fc2d66524b043a3d158705:
title: 'staging: ks7010: disable bh on tx_dev_lock'
mainline: 058cbee52ccd7be77e373d31a4f14670cfd32018
backport: f22c4b1e57a22b1e5b6a0754286c8136ed290c14
263bcebf5c2ab1fe949517225157f34015124620:
title: 'binfmt_misc: cleanup on filesystem umount'
mainline: 1c5976ef0f7ad76319df748ccb99a4c7ba2ba464
backport: 0f4437492406977e2f14c77e67956facd888765d
5fe4af45db7988a0df3533d45aba085771654811:
title: 'scsi: spi: Fix sshdr use'
mainline: 0b149cee836aa53989ea089af1cb9d90d7c6ac9e
backport: 5e532c67718aa680857ff1bf76bf470f93dbf92d
686ef69ca191dcba8d325334c65a04a2589383e6:
title: 'gfs2: setattr_chown: Add missing initialization'
mainline: 2d8d7990619878a848b1d916c2f936d3012ee17d
backport: 431cbbd124292f497b4862a88ac60015765adb49
6b344eb86f3b47e18d8fc2b0ae3e8e927f098994:
title: 'wifi: iwlwifi: abort scan when rfkill on but device enabled'
mainline: 3c6a0b1f0add72e7f522bc9145222b86d0a7712a
backport: e0961317d13c9d29d8901ab4053bf102b9595b6e
479a0cffcca7e3672a7db5f9e23b147fb6cfba39:
title: 'powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu'
mainline: 45b1ba7e5d1f6881050d558baf9bc74a2ae13930
backport: 4297287b1132064e10b140991aa9d465d1926c24
cac7c9fcd15e92184c8e621b1f33d97d99505366:
title: 'ext4: do not trim the group with corrupted block bitmap'
mainline: 172202152a125955367393956acf5f4ffd092e0d
backport: 0c2fd9f775685c502a30310255f91b826b979cbf
c08d02053b9e98dffea9b9b378dc90547e4621e8:
title: 'quota: Remove BUG_ON from dqget()'
mainline: 249f374eb9b6b969c64212dd860cc1439674c4a8
backport: df321d5b02416398d284e7af74bf4dfce4879e83
8e31b096e2e1949bc8f0be019c9ae70d414404c6:
title: 'media: pci: cx23885: check cx23885_vdev_init() return'
mainline: 15126b916e39b0cb67026b0af3c014bfeb1f76b3
backport: 4e2660eb12ff478bc6604d3b6d34d5052a2e5a3e
8ca5b21fa9b2c13aad93a97992b92f9360988fe9:
title: 'fs: binfmt_elf_efpic: don''t use missing interpreter''s properties'
mainline: 15fd1dc3dadb4268207fa6797e753541aca09a2a
backport: eba1af4c431230bd41b1018f1000f95e02f2ef92
50568ec1402e601125845835c326310031c65c81:
title: 'scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()'
mainline: 3d0f9342ae200aa1ddc4d6e7a573c6f8f068d994
backport: 7cb20343fea9c616687a8ba6feb41a543f94e57e
7783533f788e59691102bae6e2df03f2109624de:
title: 'net/sun3_82586: Avoid reading past buffer in debug output'
mainline: 4bea747f3fbec33c16d369b2f51e55981d7c78d0
backport: 8ab663cd2711e234d222565fc86632a09319263a
5c11581df1f58c43ce8b2e9c14184ab1f75c883f:
title: 'md: clean up invalid BUG_ON in md_ioctl'
mainline: 9dd8702e7cd28ebf076ff838933f29cf671165ec
backport: 7ce64ccc2ff813b5cccd19298f889c464cab3f4d
fea29d479eb470102cd025d9279503a2bfd28c60:
title: 'parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367'
mainline: 73cb4a2d8d7e0259f94046116727084f21e4599f
backport: 172e698211ff81d1c66161b4591efc8c21c350dc
cd146e31691187ec22b404a2771db199d370d59d:
title: 'powerpc/boot: Handle allocation failure in simple_realloc()'
mainline: 69b0194ccec033c208b071e019032c1919c2822d
backport: d8893f4de9af18d7878cef063d94387d122e9901
1180feef209487d2a95ba8fede71ec6add2e8e52:
title: 'powerpc/boot: Only free if realloc() succeeds'
mainline: f2d5bccaca3e8c09c9b9c8485375f7bdbb2631d2
backport: 8d63c5821851b1b13fe34eb0d41189cc05b498a9
be9ce497c7cb293f93cf98ef563b6456bac75686:
title: 'btrfs: change BUG_ON to assertion when checking for delayed_node root'
mainline: be73f4448b607e6b7ce41cd8ef2214fdf6e7986f
backport: b52a80ebbf8e6be987ee8e40a7a1d7e550cafe3f
ebce7d482d1a08392362ddf936ffdd9244fb1ece:
title: 'btrfs: handle invalid root reference found in may_destroy_subvol()'
mainline: 6fbc6f4ac1f4907da4fc674251527e7dc79ffbf6
backport: 4ae1ece59eff262456026a20164702f8ecfa2875
f0b54836bf2ff59b866a6db481f9ad46fa30b642:
title: 'btrfs: send: handle unexpected data in header buffer in begin_cmd()'
mainline: e80e3f732cf53c64b0d811e1581470d67f6c3228
backport: b1410389811d63127bd09bd1f21adba03e686b23
5ae1493c5eac1a7a7ced34970a24cb3a5680a63b:
title: 'btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()'
mainline: f40a3ea94881f668084f68f6b9931486b1606db0
backport: 0a7ed5945f5b2fb92877188e2ebc78067937f7cc
3c2c864f19490da6e892290441ba7dcc7bae2576:
title: 'f2fs: fix to do sanity check in update_sit_entry'
mainline: 36959d18c3cf09b3c12157c6950e18652067de77
backport: 00705650825973da3c2fceae82def9e4eda121e4
29d8f0e05a33200db97d4b38c995c843a70f71e5:
title: 'usb: gadget: fsl: Increase size of name buffer for endpoints'
mainline: 87850f6cc20911e35eafcbc1d56b0d649ae9162d
backport: 7bc6f5f8bbb72993c108fa3f26283bd9c1406cc0
01ed379cb5ddc0049a348786b971fe53a31e6255:
title: 'Bluetooth: bnep: Fix out-of-bound access'
mainline: 0f0639b4d6f649338ce29c62da3ec0787fa08cd1
backport: 4eb6b4890ed3c23303144f9a5cd341b7b22a1612
4980d45cca2b1135a1ab3dea101425cf44da72cd:
title: 'NFS: avoid infinite loop in pnfs_update_layout.'
mainline: 2fdbc20036acda9e5694db74a032d3c605323005
backport: cfe972295c3312e0a91aa910d94770ecd44179ac
3979298b8033989f86d74ab47745e5fbe84a4ebb:
title: 'openrisc: Call setup_memory() earlier in the init sequence'
mainline: 7b432bf376c9c198a7ff48f1ed14a14c0ffbe1fe
backport: ca6e68d71ece21decaa46ff8b3694570e712b738
da6cc71ff6c8e6b5076e80550b4e79a3d8f111be:
title: 's390/iucv: fix receive buffer virtual vs physical address confusion'
mainline: 4e8477aeb46dfe74e829c06ea588dd00ba20c8cc
backport: 4832811162db2d2312cb89ee37849338312e6590
320bb9a5a6b79ba123d1e1f746edb52b41c7c1fb:
title: 'usb: dwc3: core: Skip setting event buffers for host only controllers'
mainline: 89d7f962994604a3e3d480832788d06179abefc5
backport: a4dc7b3a5f855afff980b9dcb0e2ceb24f7868d2
139510ec274c7cc8739bb8f63aed70e425c2f0d8:
title: 'irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc'
mainline: 382d2ffe86efb1e2fa803d2cf17e5bfc34e574f3
backport: 2236d13af575a3658cee60e8db880740509d5b66
2f64ae32831e5a2bfd0e404c6e63b399eb180a0a:
title: 'ext4: set the type of max_zeroout to unsigned int to avoid overflow'
mainline: 261341a932d9244cbcd372a3659428c8723e5a49
backport: 90ef0457118eaeab238228f223059b1f93389d73
66fce1c83e2def702dd6a7fb77e986c062b20972:
title: 'nvmet-rdma: fix possible bad dereference when freeing rsps'
mainline: 73964c1d07c054376f1b32a62548571795159148
backport: 2e31c2b032e1c2868c06b57b319907c83004eddc
ccef3adcb84816a30b8e535c8c4fcb167904e7b1:
title: 'hrtimer: Prevent queuing of hrtimer without a function callback'
mainline: 5a830bbce3af16833fe0092dec47b6dd30279825
backport: b02d82c6edb6abc9c87d281af2b3050e618f2fa1
3d89d0c4a1c6d4d2a755e826351b0a101dbc86f3:
title: 'gtp: pull network headers in gtp_dev_xmit()'
mainline: 3a3be7ff9224f424e485287b54be00d2c6bd9c40
backport: 8e448b4536e8b8cc387052bdb058ca595627bf1f
ee12aa483f6c8cecbd5a4c794867fee0e068b822:
title: 'block: use "unsigned long" for blk_validate_block_size().'
mainline: 37ae5a0f5287a52cf51242e76ccf198d02ffe495
backport: 30a1325eab21676ba9c453de44e70fe598a6b8e0
67cddb2a1b256941952ebf501f8fc4936b704c8b:
title: 'Bluetooth: Make use of __check_timeout on hci_sched_le'
mainline: 1b1d29e5149990e44634b2e681de71effd463591
backport: 52e5665bbc50c235e1498d2f40d1004c817a7895
edb7dbcf8c1e95dc18ada839526ff86df3258d11:
title: 'Bluetooth: hci_core: Fix not handling link timeouts propertly'
mainline: 116523c8fac05d1d26f748fee7919a4ec5df67ea
backport: 874a31d69b75d57b7e017d7418a5e4ab4e537dc0
08829a8ff1303b1a903d1417dc0a06ffc7d17044:
title: 'Bluetooth: hci_core: Fix LE quote calculation'
mainline: 932021a11805b9da4bd6abf66fe233cccd59fe0e
backport: ac7a5e553fe290082863eac89a4c79ec941a947c
8c9cdbf600143bd6835c8b8351e5ac956da79aec:
title: 'kcm: Serialise kcm_sendmsg() for the same socket.'
mainline: 807067bf014d4a3ae2cc55bd3de16f22a01eb580
backport: 6bff278ca0373109466e5e16c2b5b7feb2d275cc
31c28919a99f5c491e3cce4fa7293b12e330e247:
title: 'netfilter: nft_counter: Synchronize nft_counter_reset() against reader.'
mainline: a0b39e2dc7017ac667b70bdeee5293e410fab2fb
backport: 7308cdf114aa3e10b931d967f9c6224bea4da005
571567e0277008459750f0728f246086b2659429:
title: 'ipv6: prevent UAF in ip6_send_skb()'
mainline: faa389b2fbaaec7fd27a390b4896139f9da662e3
backport: 9011fa8f8e5bc75aa260d56c3c0f6fbfbd4f55d1
e15ae5f903e1e54594a55146973d1e615519ae97:
title: 'net: xilinx: axienet: Always disable promiscuous mode'
mainline: 4ae738dfef2c0323752ab81786e2d298c9939321
backport: 019fc01257a13f075f7bd93a6fa8e02d822dacbd
2eb83c10a7a5df6ba6f03bb50a22bf5b1145b050:
title: 'drm/msm: use drm_debug_enabled() to check for debug categories'
mainline: d8db0b36d888b6a5eb392f112dc156e694de2369
skipped: missing comming 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef
a996a9abce790d5bd417fac336117f0436b9f87c:
title: 'drm/msm/dpu: don''t play tricks with debug macros'
mainline: df24373435f5899a2a98b7d377479c8d4376613b
skipped: fixes patch not in branch
e97be13a9f51284da450dd2a592e3fa87b49cdc9:
title: 'mmc: mmc_test: Fix NULL dereference on allocation failure'
mainline: a1e627af32ed60713941cbfc8075d44cad07f6dd
backport: a2b9cfe9687c3389a4cbc8b8e665baad4ef6087f
11b4b0e63f2621b33b2e107407a7d67a65994ca1:
title: 'Bluetooth: MGMT: Add error handling to pair_device()'
mainline: 538fd3921afac97158d4177139a0ad39f056dbb2
backport: ff165baf4bce33ecf7d628676ff606401ceb317f
10ddadfab0272f37c9c73095c089970e65b38824:
title: 'HID: wacom: Defer calculation of resolution until resolution_code is known'
mainline: 1b8f9c1fb464968a5b18d3acc1da8c00bad24fad
backport: 0ab5b59ccee3b6a0b46021458d60a8a7d3497bcc
4ffb49d818131d1243b85e19cae23bbc27f4a409:
title: 'cxgb4: add forgotten u64 ivlan cast before shift'
mainline: 80a1e7b83bb1834b5568a3872e64c05795d88f31
skipped: fixes patch not in branch
714ac96c0d6e594b50d89d79e07ae76d22040b73:
title: 'mmc: dw_mmc: allow biu and ciu clocks to defer'
mainline: 6275c7bc8dd07644ea8142a1773d826800f0f3f7
backport: 9d1b2b527ab3dd13c18c3460b50f474ede01cacf
bfe0ba951567d9e4a2c60424d12067000ee27158:
title: 'ALSA: timer: Relax start tick time check for slave timer elements'
mainline: ccbfcac05866ebe6eb3bc6d07b51d4ed4fcde436
backport: 408390db2ed1d018b5f958bec4dc86cf1d27fe77
aea24ef5e9b2bbc5d5d05e39b10573971b91241c:
title: 'Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO'
mainline: 9c33663af9ad115f90c076a1828129a3fbadea98
backport: 2ec8267b2741c4c576ec568dbfb4802d2880345f
2829c80614890624456337e47320289112785f3e:
title: 'Input: MT - limit max slots'
mainline: 99d3bf5f7377d42f8be60a6b9cb60fb0be34dceb
backport: f0ca8ebc5b58f920ed33dd6bd7d7e515744eb362
bef72d1acb7fadfc7a9d896da5004dfa5beb106c:
title: 'tools: move alignment-related macros to new <linux/align.h>'
mainline: 10a04ff09bcc39e0044190ffe9f00f998f13647c
skipped: (unknown reason)
d35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8:
title: 'drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc'
mainline: 88a9a467c548d0b3c7761b4fd54a68e70f9c0944
backport: c3429e72b0b782a2bbaafb19d69018b65d0bd26f
0a2bab5ed161318f57134716accba0a30f3af191:
title: 'pinctrl: single: fix potential NULL dereference in pcs_get_function()'
mainline: 1c38a62f15e595346a1106025722869e87ffe044
backport: 88f275a1e9972573add8003dc920818f17e8750a
42a15750b777edcb9be4eeea16ea04c0c4869cdc:
title: 'wifi: mwifiex: duplicate static structs used in driver instances'
mainline: 27ec3c57fcadb43c79ed05b2ea31bc18c72d798a
backport: 202eaab237a3cc7da4b688a77234744f62f31ccf
ac7f3b1e424f2f38e81d27d7e1ecb30dcd9dd651:
title: 'dm suspend: return -ERESTARTSYS instead of -EINTR'
mainline: 1e1fd567d32fcf7544c6e09e0e5bc6c650da6e23
backport: 17fc0471635d9dca0781f8c90dbbd4161950b9fc
868e60c28c2e838a005b41d2f69e923a07080a48:
title: 'scsi: mpt3sas: Avoid IOMMU page faults on REPORT ZONES'
mainline: 82dbb57ac8d06dfe8227ba9ab11a49de2b475ae5
backport: 2df5bdcc5b24b465d66f322073a523ba9ed852f3
a1177ea83da87a87cc352aa41f24d61c08c80b5d:
title: 'filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64'
34666cab862a8154013713aaee0cc5da1241dd75:
title: 'media: uvcvideo: Fix integer overflow calculating timestamp'
mainline: 8676a5e796fa18f55897ca36a94b2adf7f73ebd1
backport: 16913ef7e6317548e59036f4ee331d6f2f7f8913
d9c4df80b1b009de1eb77c07e3bb4d45bd212aa5:
title: 'ata: libata-core: Fix null pointer dereference on error'
mainline: 5d92c7c566dc76d96e0e19e481d926bbe6631c1e
skipped: fixes commit 2623c7a5f2799569d8bb05eb211da524a8144cb3 not in 4.14
27d6dbdc6485d68075a0ebf8544d6425c1ed84bb:
title: 'cgroup/cpuset: Prevent UAF in proc_cpuset_show()'
mainline: 1be59c97c83ccd67a519d8a49486b3a8a73ca28a
backport: 4284ad6ee12894faa3fdfcc584a32aa4ce2a4fbc
9e235ce6facfef2cbde3e2a5f1ccce28d341880f:
title: 'memcg: enable accounting of ipc resources'
mainline: 18319498fdd4cdf8c1c2c48cd432863b1f915d6f
backport: f477af54dbe386b3ab323b5b765910e0e7851180
54eaaac622d4547b4abae7e44763b29fa0687132:
title: 'fbcon: Prevent that screen size is smaller than font size'
mainline: e64242caef18b4a5840b0e7a9bff37abd4f4f933
backport: cb4213b43b1c11a9c6a01ab412a48a78f372ec69
f453f32f13320137f2317c0ad7ae1c20508effca:
title: 'fbmem: Check virtual screen sizes in fb_set_var()'
mainline: 6c11df58fd1ac0aefcb3b227f72769272b939e56
backport: fc15b7d69dd3b6418c8de3a3ff52a2d380d76d92
6a967835748472229da405bdb7780f98084c6ebc:
title: 'net:rds: Fix possible deadlock in rds_message_put'
mainline: f1acf1ac84d2ae97b7889b87223c1064df850069
backport: ae877b9999278eedaf73d6e0e2797d3ed613d802
89db5346acb5a15e670c4fb3b8f3c30fa30ebc15:
title: 'ida: Fix crash in ida_free when the bitmap is empty'
mainline: af73483f4e8b6f5c68c9aa63257bdd929a9c194a
backport: 2cd2e32fc40226fe651a178ec13c343b18a58ba5
0d3ffbbf8631d6db0552f46250015648991c856f:
title: 'net: prevent mss overflow in skb_segment()'
mainline: 23d05d563b7e7b0314e65c8e882bc27eac2da8e7
backport: b9b5914ae919e100f936acf89c40564438eea7ca
2d63d5363dea478efd3ea37274332e399f4e5447:
title: 'soundwire: stream: fix programming slave ports for non-continous port maps'
mainline: ab8d66d132bc8f1992d3eb6cab8d32dda6733c84
skipped: fixes patch not in branch
620fe9809752fae91b4190e897b81ed9976dfb39:
title: 'gtp: fix a potential NULL pointer dereference'
mainline: defd8b3c37b0f9cb3e0f60f47d3d78d459d57fda
backport: 05748e7d5793a9b4006096221f8c991a7eaf3849
1b1f0890fb51fc50bf990a800106a133f9036f32:
title: 'net: busy-poll: use ktime_get_ns() instead of local_clock()'
mainline: 0870b0d8b393dde53106678a1e2cec9dfa52f9b7
backport: 843fa098a51e412907dcd804d8e7cc3c28945edd
43f8d47eaa36c16eb0beafdedbfba51220b4fe69:
title: 'cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller'
mainline: 0b00583ecacb0b51712a5ecd34cf7e6684307c67
backport: 0089d92552aa7a94e2edb2441fe9017e20c4f63d
50f98b68051d01216bd59df5d0673d7a442d17cd:
title: 'USB: serial: option: add MeiG Smart SRM825L'
mainline: 9a471de516c35219d1722c13367191ce1f120fe9
backport: f44a24bcd5833a5b5d32a0bab95bed37a86cbf55
9c80a94d388528add073955108a1eeeed4c1c5ea:
title: 'usb: dwc3: omap: add missing depopulate in probe error path'
mainline: 2aa765a43817ec8add990f83c8e54a9a5d87aa9c
backport: c180e1013eb6b4db7ddf220491a2e325b7fcf06e
eca3f543f817da87c00d1a5697b473efb548204f:
title: 'usb: dwc3: core: Prevent USB core invalid event buffer address access'
mainline: 14e497183df28c006603cc67fd3797a537eef7b9
backport: 347ecd5288aaff7fcc0828d8e2bbd122cce42a43
b0979a885b9d4df2a25b88e9d444ccaa5f9f495c:
title: 'usb: dwc3: st: fix probed platform device ref count on probe error path'
mainline: ddfcfeba891064b88bb844208b43bef2ef970f0c
backport: f86e58bf1c74fcdfcfb78baecf156127409442be
0e9d60d0da23b5c344aaad9cb2088684f8548f9f:
title: 'usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()'
mainline: 3a8839bbb86da7968a792123ed2296d063871a52
backport: 2a00c7c9045d6b359ab6b51e71ab4be6f4dac461
d237c7d06ffddcdb5d36948c527dc01284388218:
title: 'scsi: aacraid: Fix double-free on probe failure'
mainline: 919ddf8336f0b84c0453bac583808c9f165a85c2
backport: caebf7249fb7bd0cb68e7b6f8a88f033d82ac221
72793f5cc9e41f9ee33353d4594036817529b766:
title: 'ipc: remove memcg accounting for sops objects in do_semtimedop()'
mainline: 6a4746ba06191e23d30230738e94334b26590a8a
backport: 30eb6ce857111743822a317414a1f183319a105a
0975670c14287183571d01858e8020114a14d76a:
title: 'drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var'
mainline: 1935f0deb6116dd785ea64d8035eab0ff441255b
backport: 6c3aa8fda82fedf05e697ef8c57d92c3b9d838b8

2
Makefile
View File

@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
VERSION = 4
PATCHLEVEL = 14
SUBLEVEL = 353
SUBLEVEL = 354
EXTRAVERSION = -openela
NAME = Petit Gorille

6
arch/openrisc/kernel/setup.c
View File

@ -266,6 +266,9 @@ void calibrate_delay(void)
void __init setup_arch(char **cmdline_p)
{
/* setup memblock allocator */
setup_memory();
unflatten_and_copy_device_tree();
setup_cpuinfo();
@ -286,9 +289,6 @@ void __init setup_arch(char **cmdline_p)
initrd_below_start_ok = 1;
#endif
/* setup memblock allocator */
setup_memory();
/* paging_init() sets up the MMU and marks all pages as reserved */
paging_init();

4
arch/parisc/kernel/irq.c
View File

@ -524,7 +524,7 @@ void do_cpu_irq_mask(struct pt_regs *regs)
old_regs = set_irq_regs(regs);
local_irq_disable();
irq_enter();
irq_enter_rcu();
eirr_val = mfctl(23) & cpu_eiem & per_cpu(local_ack_eiem, cpu);
if (!eirr_val)
@ -559,7 +559,7 @@ void do_cpu_irq_mask(struct pt_regs *regs)
#endif /* CONFIG_IRQSTACKS */
out:
irq_exit();
irq_exit_rcu();
set_irq_regs(old_regs);
return;

7
arch/powerpc/boot/simple_alloc.c
View File

@ -114,8 +114,11 @@ static void *simple_realloc(void *ptr, unsigned long size)
return ptr;
new = simple_malloc(size);
memcpy(new, ptr, p->size);
simple_free(ptr);
if (new) {
memcpy(new, ptr, p->size);
simple_free(ptr);
}
return new;
}

2
arch/powerpc/sysdev/xics/icp-native.c
View File

@ -240,6 +240,8 @@ static int __init icp_native_map_one_cpu(int hw_id, unsigned long addr,
rname = kasprintf(GFP_KERNEL, "CPU %d [0x%x] Interrupt Presentation",
cpu, hw_id);
if (!rname)
return -ENOMEM;
if (!request_mem_region(addr, size, rname)) {
pr_warning("icp_native: Could not reserve ICP MMIO"
" for CPU %d, interrupt server #0x%x\n",

9
drivers/atm/idt77252.c
View File

@ -1117,8 +1117,8 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
rpp->len += skb->len;
if (stat & SAR_RSQE_EPDU) {
unsigned int len, truesize;
unsigned char *l1l2;
unsigned int len;
l1l2 = (unsigned char *) ((unsigned long) skb->data + skb->len - 6);
@ -1188,14 +1188,15 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
ATM_SKB(skb)->vcc = vcc;
__net_timestamp(skb);
truesize = skb->truesize;
vcc->push(vcc, skb);
atomic_inc(&vcc->stats->rx);
if (skb->truesize > SAR_FB_SIZE_3)
if (truesize > SAR_FB_SIZE_3)
add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
else if (skb->truesize > SAR_FB_SIZE_2)
else if (truesize > SAR_FB_SIZE_2)
add_rx_skb(card, 2, SAR_FB_SIZE_2, 1);
else if (skb->truesize > SAR_FB_SIZE_1)
else if (truesize > SAR_FB_SIZE_1)
add_rx_skb(card, 1, SAR_FB_SIZE_1, 1);
else
add_rx_skb(card, 0, SAR_FB_SIZE_0, 1);

3
drivers/bluetooth/hci_ldisc.c
View File

@ -769,7 +769,8 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file *file,
break;
case HCIUARTGETPROTO:
if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
if (test_bit(HCI_UART_PROTO_SET, &hu->flags) &&
test_bit(HCI_UART_PROTO_READY, &hu->flags))
err = hu->proto->id;
else
err = -EUNATCH;

6
drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
View File

@ -203,13 +203,19 @@ int amdgpu_ctx_ioctl(struct drm_device *dev, void *data,
switch (args->in.op) {
case AMDGPU_CTX_OP_ALLOC_CTX:
if (args->in.flags)
return -EINVAL;
r = amdgpu_ctx_alloc(adev, fpriv, &id);
args->out.alloc.ctx_id = id;
break;
case AMDGPU_CTX_OP_FREE_CTX:
if (args->in.flags)
return -EINVAL;
r = amdgpu_ctx_free(fpriv, id);
break;
case AMDGPU_CTX_OP_QUERY_STATE:
if (args->in.flags)
return -EINVAL;
r = amdgpu_ctx_query(adev, fpriv, id, &args->out);
break;
default:

3
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
View File

@ -647,7 +647,8 @@ int amdgpu_vce_ring_parse_cs(struct amdgpu_cs_parser *p, uint32_t ib_idx)
uint32_t created = 0;
uint32_t allocated = 0;
uint32_t tmp, handle = 0;
uint32_t *size = &tmp;
uint32_t dummy = 0xffffffff;
uint32_t *size = &dummy;
int i, r = 0, idx = 0;
p->job->vm = NULL;

3
drivers/gpu/drm/drm_fb_helper.c
View File

@ -1601,6 +1601,9 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
return -EINVAL;
}
var->xres_virtual = fb->width;
var->yres_virtual = fb->height;
/*
* Workaround for SDL 1.2, which is known to be setting all pixel format
* fields values to zero in some cases. We treat this situation as a

4
drivers/hid/wacom_wac.c
View File

@ -1735,12 +1735,14 @@ static void wacom_map_usage(struct input_dev *input, struct hid_usage *usage,
int fmax = field->logical_maximum;
unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid);
int resolution_code = code;
int resolution = hidinput_calc_abs_res(field, resolution_code);
int resolution;
if (equivalent_usage == HID_DG_TWIST) {
resolution_code = ABS_RZ;
}
resolution = hidinput_calc_abs_res(field, resolution_code);
if (equivalent_usage == HID_GD_X) {
fmin += features->offset_left;
fmax -= features->offset_right;

3
drivers/input/input-mt.c
View File

@ -48,6 +48,9 @@ int input_mt_init_slots(struct input_dev *dev, unsigned int num_slots,
return 0;
if (mt)
return mt->num_slots != num_slots ? -EINVAL : 0;
/* Arbitrary limit for avoiding too large memory allocation. */
if (num_slots > 1024)
return -EINVAL;
mt = kzalloc(sizeof(*mt) + num_slots * sizeof(*mt->slots), GFP_KERNEL);
if (!mt)

2
drivers/irqchip/irq-gic-v3-its.c
View File

@ -2692,8 +2692,6 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
struct page *vprop_page;
int base, nr_ids, i, err = 0;
BUG_ON(!vm);
bitmap = its_lpi_alloc_chunks(nr_irqs, &base, &nr_ids);
if (!bitmap)
return -ENOMEM;

22
drivers/md/dm-ioctl.c
View File

@ -1039,8 +1039,26 @@ static int do_resume(struct dm_ioctl *param)
suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG;
if (param->flags & DM_NOFLUSH_FLAG)
suspend_flags |= DM_SUSPEND_NOFLUSH_FLAG;
if (!dm_suspended_md(md))
dm_suspend(md, suspend_flags);
if (!dm_suspended_md(md)) {
r = dm_suspend(md, suspend_flags);
if (r) {
down_write(&_hash_lock);
hc = dm_get_mdptr(md);
if (hc && !hc->new_map) {
hc->new_map = new_map;
new_map = NULL;
} else {
r = -ENXIO;
}
up_write(&_hash_lock);
if (new_map) {
dm_sync_table(md);
dm_table_destroy(new_map);
}
dm_put(md);
return r;
}
}
old_map = dm_swap_table(md, new_map);
if (IS_ERR(old_map)) {

2
drivers/md/dm.c
View File

@ -2396,7 +2396,7 @@ static int dm_wait_for_completion(struct mapped_device *md, long task_state)
break;
if (signal_pending_state(task_state, current)) {
r = -EINTR;
r = -ERESTARTSYS;
break;
}

5
drivers/md/md.c
View File

@ -7215,11 +7215,6 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
mddev = bdev->bd_disk->private_data;
if (!mddev) {
BUG();
goto out;
}
/* Some actions do not requires the mutex */
switch (cmd) {
case GET_ARRAY_INFO:

4
drivers/md/persistent-data/dm-space-map-metadata.c
View File

@ -274,7 +274,7 @@ static void sm_metadata_destroy(struct dm_space_map *sm)
{
struct sm_metadata *smm = container_of(sm, struct sm_metadata, sm);
kfree(smm);
kvfree(smm);
}
static int sm_metadata_get_nr_blocks(struct dm_space_map *sm, dm_block_t *count)
@ -758,7 +758,7 @@ struct dm_space_map *dm_sm_metadata_init(void)
{
struct sm_metadata *smm;
smm = kmalloc(sizeof(*smm), GFP_KERNEL);
smm = kvmalloc(sizeof(*smm), GFP_KERNEL);
if (!smm)
return ERR_PTR(-ENOMEM);

8
drivers/media/pci/cx23885/cx23885-video.c
View File

@ -1293,6 +1293,10 @@ int cx23885_video_register(struct cx23885_dev *dev)
/* register Video device */
dev->video_dev = cx23885_vdev_init(dev, dev->pci,
&cx23885_video_template, "video");
if (!dev->video_dev) {
err = -ENOMEM;
goto fail_unreg;
}
dev->video_dev->queue = &dev->vb2_vidq;
err = video_register_device(dev->video_dev, VFL_TYPE_GRABBER,
video_nr[dev->nr]);
@ -1307,6 +1311,10 @@ int cx23885_video_register(struct cx23885_dev *dev)
/* register VBI device */
dev->vbi_dev = cx23885_vdev_init(dev, dev->pci,
&cx23885_vbi_template, "vbi");
if (!dev->vbi_dev) {
err = -ENOMEM;
goto fail_unreg;
}
dev->vbi_dev->queue = &dev->vb2_vbiq;
err = video_register_device(dev->vbi_dev, VFL_TYPE_VBI,
vbi_nr[dev->nr]);

45
drivers/media/usb/uvc/uvc_video.c
View File

@ -408,12 +408,12 @@ static int uvc_commit_video(struct uvc_streaming *stream,
* Clocks and timestamps
*/
static inline void uvc_video_get_ts(struct timespec *ts)
static inline ktime_t uvc_video_get_time(void)
{
if (uvc_clock_param == CLOCK_MONOTONIC)
ktime_get_ts(ts);
return ktime_get();
else
ktime_get_real_ts(ts);
return ktime_get_real();
}
static void
@ -425,7 +425,7 @@ uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
bool has_pts = false;
bool has_scr = false;
unsigned long flags;
struct timespec ts;
ktime_t time;
u16 host_sof;
u16 dev_sof;
u32 dev_stc;
@ -504,7 +504,7 @@ uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
stream->clock.last_sof = dev_sof;
host_sof = usb_get_current_frame_number(stream->dev->udev);
uvc_video_get_ts(&ts);
time = uvc_video_get_time();
/* The UVC specification allows device implementations that can't obtain
* the USB frame number to keep their own frame counters as long as they
@ -541,7 +541,7 @@ uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
sample->dev_stc = dev_stc;
sample->dev_sof = dev_sof;
sample->host_sof = host_sof;
sample->host_ts = ts;
sample->host_time = time;
/* Update the sliding window head and count. */
stream->clock.head = (stream->clock.head + 1) % stream->clock.size;
@ -681,15 +681,13 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
struct uvc_clock_sample *first;
struct uvc_clock_sample *last;
unsigned long flags;
struct timespec ts;
u64 timestamp;
u32 delta_stc;
u32 y1, y2;
u32 y1;
u32 x1, x2;
u32 mean;
u32 sof;
u32 div;
u32 rem;
u64 y;
u64 y, y2;
if (!uvc_hw_timestamps_param)
return;
@ -729,7 +727,7 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
sof = y;
uvc_trace(UVC_TRACE_CLOCK, "%s: PTS %u y %llu.%06llu SOF %u.%06llu "
"(x1 %u x2 %u y1 %u y2 %u SOF offset %u)\n",
"(x1 %u x2 %u y1 %u y2 %llu SOF offset %u)\n",
stream->dev->name, buf->pts,
y >> 16, div_u64((y & 0xffff) * 1000000, 65536),
sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536),
@ -743,9 +741,8 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
if (x1 == x2)
goto done;
ts = timespec_sub(last->host_ts, first->host_ts);
y1 = NSEC_PER_SEC;
y2 = (ts.tv_sec + 1) * NSEC_PER_SEC + ts.tv_nsec;
y2 = ktime_to_ns(ktime_sub(last->host_time, first->host_time)) + y1;
/* Interpolated and host SOF timestamps can wrap around at slightly
* different times. Handle this by adding or removing 2048 to or from
@ -762,24 +759,18 @@ void uvc_video_clock_update(struct uvc_streaming *stream,
- (u64)y2 * (u64)x1;
y = div_u64(y, x2 - x1);
div = div_u64_rem(y, NSEC_PER_SEC, &rem);
ts.tv_sec = first->host_ts.tv_sec - 1 + div;
ts.tv_nsec = first->host_ts.tv_nsec + rem;
if (ts.tv_nsec >= NSEC_PER_SEC) {
ts.tv_sec++;
ts.tv_nsec -= NSEC_PER_SEC;
}
timestamp = ktime_to_ns(first->host_time) + y - y1;
uvc_trace(UVC_TRACE_CLOCK, "%s: SOF %u.%06llu y %llu ts %llu "
"buf ts %llu (x1 %u/%u/%u x2 %u/%u/%u y1 %u y2 %u)\n",
"buf ts %llu (x1 %u/%u/%u x2 %u/%u/%u y1 %u y2 %llu)\n",
stream->dev->name,
sof >> 16, div_u64(((u64)sof & 0xffff) * 1000000LLU, 65536),
y, timespec_to_ns(&ts), vbuf->vb2_buf.timestamp,
y, timestamp, vbuf->vb2_buf.timestamp,
x1, first->host_sof, first->dev_sof,
x2, last->host_sof, last->dev_sof, y1, y2);
/* Update the V4L2 buffer. */
vbuf->vb2_buf.timestamp = timespec_to_ns(&ts);
vbuf->vb2_buf.timestamp = timestamp;
done:
spin_unlock_irqrestore(&clock->lock, flags);
@ -1086,8 +1077,6 @@ static int uvc_video_decode_start(struct uvc_streaming *stream,
* when the EOF bit is set to force synchronisation on the next packet.
*/
if (buf->state != UVC_BUF_STATE_ACTIVE) {
struct timespec ts;
if (fid == stream->last_fid) {
uvc_trace(UVC_TRACE_FRAME, "Dropping payload (out of "
"sync).\n");
@ -1097,11 +1086,9 @@ static int uvc_video_decode_start(struct uvc_streaming *stream,
return -ENODATA;
}
uvc_video_get_ts(&ts);
buf->buf.field = V4L2_FIELD_NONE;
buf->buf.sequence = stream->sequence;
buf->buf.vb2_buf.timestamp = timespec_to_ns(&ts);
buf->buf.vb2_buf.timestamp = uvc_video_get_time();
/* TODO: Handle PTS and SCR. */
buf->state = UVC_BUF_STATE_ACTIVE;

2
drivers/media/usb/uvc/uvcvideo.h
View File

@ -536,8 +536,8 @@ struct uvc_streaming {
struct uvc_clock_sample {
u32 dev_stc;
u16 dev_sof;
struct timespec host_ts;
u16 host_sof;
ktime_t host_time;
} *samples;
unsigned int head;

9
drivers/mmc/core/mmc_test.c
View File

@ -3119,13 +3119,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL);
#ifdef CONFIG_HIGHMEM
test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER);
if (!test->highmem) {
count = -ENOMEM;
goto free_test_buffer;
}
#endif
#ifdef CONFIG_HIGHMEM
if (test->buffer && test->highmem) {
#else
if (test->buffer) {
#endif
mutex_lock(&mmc_test_lock);
mmc_test_run(test, testcase);
mutex_unlock(&mmc_test_lock);
@ -3134,6 +3134,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf,
#ifdef CONFIG_HIGHMEM
if (test->highmem)
__free_pages(test->highmem, BUFFER_ORDER);
free_test_buffer:
#endif
kfree(test->buffer);
kfree(test);

8
drivers/mmc/host/dw_mmc.c
View File

@ -3192,6 +3192,10 @@ int dw_mci_probe(struct dw_mci *host)
host->biu_clk = devm_clk_get(host->dev, "biu");
if (IS_ERR(host->biu_clk)) {
dev_dbg(host->dev, "biu clock not available\n");
ret = PTR_ERR(host->biu_clk);
if (ret == -EPROBE_DEFER)
return ret;
} else {
ret = clk_prepare_enable(host->biu_clk);
if (ret) {
@ -3203,6 +3207,10 @@ int dw_mci_probe(struct dw_mci *host)
host->ciu_clk = devm_clk_get(host->dev, "ciu");
if (IS_ERR(host->ciu_clk)) {
dev_dbg(host->dev, "ciu clock not available\n");
ret = PTR_ERR(host->ciu_clk);
if (ret == -EPROBE_DEFER)
goto err_clk_biu;
host->bus_hz = host->pdata->bus_hz;
} else {
ret = clk_prepare_enable(host->ciu_clk);

2
drivers/net/ethernet/i825xx/sun3_82586.c
View File

@ -989,7 +989,7 @@ static void sun3_82586_timeout(struct net_device *dev)
{
#ifdef DEBUG
printk("%s: xmitter timed out, try to restart! stat: %02x\n",dev->name,p->scb->cus);
printk("%s: command-stats: %04x %04x\n",dev->name,swab16(p->xmit_cmds[0]->cmd_status),swab16(p->xmit_cmds[1]->cmd_status));
printk("%s: command-stats: %04x\n", dev->name, swab16(p->xmit_cmds[0]->cmd_status));
printk("%s: check, whether you set the right interrupt number!\n",dev->name);
#endif
sun3_82586_close(dev);

4
drivers/net/ethernet/xilinx/xilinx_axienet_main.c
View File

@ -365,6 +365,10 @@ static void axienet_set_multicast_list(struct net_device *ndev)
} else if (!netdev_mc_empty(ndev)) {
struct netdev_hw_addr *ha;
reg = axienet_ior(lp, XAE_FMI_OFFSET);
reg &= ~XAE_FMI_PM_MASK;
axienet_iow(lp, XAE_FMI_OFFSET, reg);
i = 0;
netdev_for_each_mc_addr(ha, ndev) {
if (i >= XAE_MULTICAST_CAM_TABLE_NUM)

5
drivers/net/gtp.c
View File

@ -576,6 +576,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev)
if (skb_cow_head(skb, dev->needed_headroom))
goto tx_err;
if (!pskb_inet_may_pull(skb))
goto tx_err;
skb_reset_inner_headers(skb);
/* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */
@ -808,7 +811,7 @@ static struct sock *gtp_encap_enable_socket(int fd, int type,
sock = sockfd_lookup(fd, &err);
if (!sock) {
pr_debug("gtp socket fd=%d not found\n", fd);
return NULL;
return ERR_PTR(err);
}
sk = sock->sk;

2
drivers/net/wireless/intel/iwlwifi/mvm/scan.c
View File

@ -1783,7 +1783,7 @@ int iwl_mvm_scan_stop(struct iwl_mvm *mvm, int type, bool notify)
if (!(mvm->scan_status & type))
return 0;
if (iwl_mvm_is_radio_killed(mvm)) {
if (!test_bit(STATUS_DEVICE_ENABLED, &mvm->trans->status)) {
ret = 0;
goto out;
}

32
drivers/net/wireless/marvell/mwifiex/cfg80211.c
View File

@ -4258,11 +4258,27 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
BIT(NL80211_IFTYPE_P2P_GO) |
BIT(NL80211_IFTYPE_AP);
wiphy->bands[NL80211_BAND_2GHZ] = &mwifiex_band_2ghz;
if (adapter->config_bands & BAND_A)
wiphy->bands[NL80211_BAND_5GHZ] = &mwifiex_band_5ghz;
else
wiphy->bands[NL80211_BAND_2GHZ] = devm_kmemdup(adapter->dev,
&mwifiex_band_2ghz,
sizeof(mwifiex_band_2ghz),
GFP_KERNEL);
if (!wiphy->bands[NL80211_BAND_2GHZ]) {
ret = -ENOMEM;
goto err;
}
if (adapter->config_bands & BAND_A) {
wiphy->bands[NL80211_BAND_5GHZ] = devm_kmemdup(adapter->dev,
&mwifiex_band_5ghz,
sizeof(mwifiex_band_5ghz),
GFP_KERNEL);
if (!wiphy->bands[NL80211_BAND_5GHZ]) {
ret = -ENOMEM;
goto err;
}
} else {
wiphy->bands[NL80211_BAND_5GHZ] = NULL;
}
if (adapter->drcs_enabled && ISSUPP_DRCS_ENABLED(adapter->fw_cap_info))
wiphy->iface_combinations = &mwifiex_iface_comb_ap_sta_drcs;
@ -4343,8 +4359,7 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
if (ret < 0) {
mwifiex_dbg(adapter, ERROR,
"%s: wiphy_register failed: %d\n", __func__, ret);
wiphy_free(wiphy);
return ret;
goto err;
}
if (!adapter->regd) {
@ -4386,4 +4401,9 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
adapter->wiphy = wiphy;
return ret;
err:
wiphy_free(wiphy);
return ret;
}

2
drivers/net/wireless/st/cw1200/txrx.c
View File

@ -1173,7 +1173,7 @@ void cw1200_rx_cb(struct cw1200_common *priv,
size_t ies_len = skb->len - (ies - (u8 *)(skb->data));
tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies, ies_len);
if (tim_ie) {
if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
struct ieee80211_tim_ie *tim =
(struct ieee80211_tim_ie *)&tim_ie[2];

16
drivers/nvme/target/rdma.c
View File

@ -435,12 +435,8 @@ nvmet_rdma_alloc_rsps(struct nvmet_rdma_queue *queue)
return 0;
out_free:
while (--i >= 0) {
struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
list_del(&rsp->free_list);
nvmet_rdma_free_rsp(ndev, rsp);
}
while (--i >= 0)
nvmet_rdma_free_rsp(ndev, &queue->rsps[i]);
kfree(queue->rsps);
out:
return ret;
@ -451,12 +447,8 @@ static void nvmet_rdma_free_rsps(struct nvmet_rdma_queue *queue)
struct nvmet_rdma_device *ndev = queue->dev;
int i, nr_rsps = queue->recv_queue_size * 2;
for (i = 0; i < nr_rsps; i++) {
struct nvmet_rdma_rsp *rsp = &queue->rsps[i];
list_del(&rsp->free_list);
nvmet_rdma_free_rsp(ndev, rsp);
}
for (i = 0; i < nr_rsps; i++)
nvmet_rdma_free_rsp(ndev, &queue->rsps[i]);
kfree(queue->rsps);
}

2
drivers/pinctrl/pinctrl-single.c
View File

@ -317,6 +317,8 @@ static int pcs_get_function(struct pinctrl_dev *pctldev, unsigned pin,
return -ENOTSUPP;
fselector = setting->func;
function = pinmux_generic_get_function(pctldev, fselector);
if (!function)
return -EINVAL;
*func = function->data;
if (!(*func)) {
dev_err(pcs->dev, "%s could not find function%i\n",

10
drivers/s390/cio/idset.c
View File

@ -16,7 +16,7 @@ struct idset {
unsigned long bitmap[0];
};
static inline unsigned long bitmap_size(int num_ssid, int num_id)
static inline unsigned long idset_bitmap_size(int num_ssid, int num_id)
{
return BITS_TO_LONGS(num_ssid * num_id) * sizeof(unsigned long);
}
@ -25,11 +25,12 @@ static struct idset *idset_new(int num_ssid, int num_id)
{
struct idset *set;
set = vmalloc(sizeof(struct idset) + bitmap_size(num_ssid, num_id));
set = vmalloc(sizeof(struct idset) +
idset_bitmap_size(num_ssid, num_id));
if (set) {
set->num_ssid = num_ssid;
set->num_id = num_id;
memset(set->bitmap, 0, bitmap_size(num_ssid, num_id));
memset(set->bitmap, 0, idset_bitmap_size(num_ssid, num_id));
}
return set;
}
@ -41,7 +42,8 @@ void idset_free(struct idset *set)
void idset_fill(struct idset *set)
{
memset(set->bitmap, 0xff, bitmap_size(set->num_ssid, set->num_id));
memset(set->bitmap, 0xff,
idset_bitmap_size(set->num_ssid, set->num_id));
}
static inline void idset_add(struct idset *set, int ssid, int id)

2
drivers/scsi/aacraid/comminit.c
View File

@ -613,6 +613,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev)
if (aac_comm_init(dev)<0){
kfree(dev->queues);
dev->queues = NULL;
return NULL;
}
/*
@ -620,6 +621,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev)
*/
if (aac_fib_setup(dev) < 0) {
kfree(dev->queues);
dev->queues = NULL;
return NULL;
}

2
drivers/scsi/lpfc/lpfc_sli.c
View File

@ -6383,7 +6383,7 @@ lpfc_sli4_repost_sgl_list(struct lpfc_hba *phba,
struct lpfc_sglq *sglq_entry = NULL;
struct lpfc_sglq *sglq_entry_next = NULL;
struct lpfc_sglq *sglq_entry_first = NULL;
int status, total_cnt;
int status = 0, total_cnt;
int post_cnt = 0, num_posted = 0, block_cnt = 0;
int last_xritag = NO_XRI;
LIST_HEAD(prep_sgl_list);

20
drivers/scsi/mpt3sas/mpt3sas_base.c
View File

@ -1389,6 +1389,22 @@ _base_build_zero_len_sge_ieee(struct MPT3SAS_ADAPTER *ioc, void *paddr)
_base_add_sg_single_ieee(paddr, sgl_flags, 0, 0, -1);
}
static inline int _base_scsi_dma_map(struct scsi_cmnd *cmd)
{
/*
* Some firmware versions byte-swap the REPORT ZONES command reply from
* ATA-ZAC devices by directly accessing in the host buffer. This does
* not respect the default command DMA direction and causes IOMMU page
* faults on some architectures with an IOMMU enforcing write mappings
* (e.g. AMD hosts). Avoid such issue by making the report zones buffer
* mapping bi-directional.
*/
if (cmd->cmnd[0] == ZBC_IN && cmd->cmnd[1] == ZI_REPORT_ZONES)
cmd->sc_data_direction = DMA_BIDIRECTIONAL;
return scsi_dma_map(cmd);
}
/**
* _base_build_sg_scmd - main sg creation routine
* @ioc: per adapter object
@ -1433,7 +1449,7 @@ _base_build_sg_scmd(struct MPT3SAS_ADAPTER *ioc,
sgl_flags = sgl_flags << MPI2_SGE_FLAGS_SHIFT;
sg_scmd = scsi_sglist(scmd);
sges_left = scsi_dma_map(scmd);
sges_left = _base_scsi_dma_map(scmd);
if (sges_left < 0) {
sdev_printk(KERN_ERR, scmd->device,
"pci_map_sg failed: request for %d bytes!\n",
@ -1572,7 +1588,7 @@ _base_build_sg_scmd_ieee(struct MPT3SAS_ADAPTER *ioc,
MPI2_IEEE_SGE_FLAGS_SYSTEM_ADDR;
sg_scmd = scsi_sglist(scmd);
sges_left = scsi_dma_map(scmd);
sges_left = _base_scsi_dma_map(scmd);
if (sges_left < 0) {
sdev_printk(KERN_ERR, scmd->device,
"pci_map_sg failed: request for %d bytes!\n",

4
drivers/scsi/scsi_transport_spi.c
View File

@ -683,10 +683,10 @@ spi_dv_device_echo_buffer(struct scsi_device *sdev, u8 *buffer,
for (r = 0; r < retries; r++) {
result = spi_execute(sdev, spi_write_buffer, DMA_TO_DEVICE,
buffer, len, &sshdr);
if(result || !scsi_device_online(sdev)) {
if (result || !scsi_device_online(sdev)) {
scsi_device_set_state(sdev, SDEV_QUIESCE);
if (scsi_sense_valid(&sshdr)
if (result > 0 && scsi_sense_valid(&sshdr)
&& sshdr.sense_key == ILLEGAL_REQUEST
/* INVALID FIELD IN CDB */
&& sshdr.asc == 0x24 && sshdr.ascq == 0x00)

2
drivers/ssb/main.c
View File

@ -830,7 +830,7 @@ static u32 clkfactor_f6_resolve(u32 v)
case SSB_CHIPCO_CLK_F6_7:
return 7;
}
return 0;
return 1;
}
/* Calculate the speed the backplane would run at a given set of clockcontrol values */

4
drivers/staging/ks7010/ks7010_sdio.c
View File

@ -339,9 +339,9 @@ int ks_wlan_hw_tx(struct ks_wlan_private *priv, void *p, unsigned long size,
priv->hostt.qtail = (priv->hostt.qtail + 1) % SME_EVENT_BUFF_SIZE;
DPRINTK(4, "event=%04X\n", hdr->event);
spin_lock(&priv->tx_dev.tx_dev_lock);
spin_lock_bh(&priv->tx_dev.tx_dev_lock);
result = enqueue_txdev(priv, p, size, complete_handler, skb);
spin_unlock(&priv->tx_dev.tx_dev_lock);
spin_unlock_bh(&priv->tx_dev.tx_dev_lock);
if (cnt_txqbody(priv) > 0)
queue_delayed_work(priv->wq, &priv->rw_dwork, 0);

3
drivers/usb/class/cdc-acm.c
View File

@ -1818,6 +1818,9 @@ static const struct usb_device_id acm_ids[] = {
{ USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */
.driver_info = SINGLE_RX_URB,
},
{ USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */
.driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
},
{ USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */
.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
},

1
drivers/usb/core/sysfs.c
View File

@ -668,6 +668,7 @@ static int add_power_attributes(struct device *dev)
static void remove_power_attributes(struct device *dev)
{
sysfs_unmerge_group(&dev->kobj, &usb3_hardware_lpm_attr_group);
sysfs_unmerge_group(&dev->kobj, &usb2_hardware_lpm_attr_group);
sysfs_unmerge_group(&dev->kobj, &power_attr_group);
}

21
drivers/usb/dwc3/core.c
View File

@ -394,6 +394,13 @@ static void dwc3_free_event_buffers(struct dwc3 *dwc)
static int dwc3_alloc_event_buffers(struct dwc3 *dwc, unsigned length)
{
struct dwc3_event_buffer *evt;
unsigned int hw_mode;
hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0);
if (hw_mode == DWC3_GHWPARAMS0_MODE_HOST) {
dwc->ev_buf = NULL;
return 0;
}
evt = dwc3_alloc_one_event_buffer(dwc, length);
if (IS_ERR(evt)) {
@ -417,6 +424,9 @@ int dwc3_event_buffers_setup(struct dwc3 *dwc)
{
struct dwc3_event_buffer *evt;
if (!dwc->ev_buf)
return 0;
evt = dwc->ev_buf;
evt->lpos = 0;
dwc3_writel(dwc->regs, DWC3_GEVNTADRLO(0),
@ -435,6 +445,17 @@ int dwc3_event_buffers_setup(struct dwc3 *dwc)
static void dwc3_event_buffers_cleanup(struct dwc3 *dwc)
{
struct dwc3_event_buffer *evt;
u32 reg;
if (!dwc->ev_buf)
return;
/*
* Exynos platforms may not be able to access event buffer if the
* controller failed to halt on dwc3_core_exit().
*/
reg = dwc3_readl(dwc->regs, DWC3_DSTS);
if (!(reg & DWC3_DSTS_DEVCTRLHLT))
return;
evt = dwc->ev_buf;

4
drivers/usb/dwc3/dwc3-omap.c
View File

@ -534,11 +534,13 @@ static int dwc3_omap_probe(struct platform_device *pdev)
if (ret) {
dev_err(dev, "failed to request IRQ #%d --> %d\n",
omap->irq, ret);
goto err1;
goto err2;
}
dwc3_omap_enable_irqs(omap);
return 0;
err2:
of_platform_depopulate(dev);
err1:
pm_runtime_put_sync(dev);
pm_runtime_disable(dev);

11
drivers/usb/dwc3/dwc3-st.c
View File

@ -223,10 +223,8 @@ static int st_dwc3_probe(struct platform_device *pdev)
dwc3_data->regmap = regmap;
res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg");
if (!res) {
ret = -ENXIO;
goto undo_platform_dev_alloc;
}
if (!res)
return -ENXIO;
dwc3_data->syscfg_reg_off = res->start;
@ -237,8 +235,7 @@ static int st_dwc3_probe(struct platform_device *pdev)
devm_reset_control_get_exclusive(dev, "powerdown");
if (IS_ERR(dwc3_data->rstc_pwrdn)) {
dev_err(&pdev->dev, "could not get power controller\n");
ret = PTR_ERR(dwc3_data->rstc_pwrdn);
goto undo_platform_dev_alloc;
return PTR_ERR(dwc3_data->rstc_pwrdn);
}
/* Manage PowerDown */
@ -300,8 +297,6 @@ undo_softreset:
reset_control_assert(dwc3_data->rstc_rst);
undo_powerdown:
reset_control_assert(dwc3_data->rstc_pwrdn);
undo_platform_dev_alloc:
platform_device_put(pdev);
return ret;
}

2
drivers/usb/gadget/udc/fsl_udc_core.c
View File

@ -2496,7 +2496,7 @@ static int fsl_udc_probe(struct platform_device *pdev)
/* setup the udc->eps[] for non-control endpoints and link
* to gadget.ep_list */
for (i = 1; i < (int)(udc_controller->max_ep / 2); i++) {
char name[14];
char name[16];
sprintf(name, "ep%dout", i);
struct_ep_setup(udc_controller, i * 2, name, 1);

5
drivers/usb/serial/option.c
View File

@ -622,6 +622,8 @@ static void option_instat_callback(struct urb *urb);
/* MeiG Smart Technology products */
#define MEIGSMART_VENDOR_ID 0x2dee
/* MeiG Smart SRM825L based on Qualcomm 315 */
#define MEIGSMART_PRODUCT_SRM825L 0x4d22
/* MeiG Smart SLM320 based on UNISOC UIS8910 */
#define MEIGSMART_PRODUCT_SLM320 0x4d41
@ -2368,6 +2370,9 @@ static const struct usb_device_id option_ids[] = {
{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) },
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);

28
drivers/video/fbdev/core/fbcon.c
View File

@ -2710,6 +2710,34 @@ static void fbcon_set_all_vcs(struct fb_info *info)
fbcon_modechanged(info);
}
/* let fbcon check if it supports a new screen resolution */
int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *var)
{
struct fbcon_ops *ops = info->fbcon_par;
struct vc_data *vc;
unsigned int i;
WARN_CONSOLE_UNLOCKED();
if (!ops)
return 0;
/* prevent setting a screen size which is smaller than font size */
for (i = first_fb_vc; i <= last_fb_vc; i++) {
vc = vc_cons[i].d;
if (!vc || vc->vc_mode != KD_TEXT ||
registered_fb[con2fb_map[i]] != info)
continue;
if (vc->vc_font.width > FBCON_SWAP(var->rotate, var->xres, var->yres) ||
vc->vc_font.height > FBCON_SWAP(var->rotate, var->yres, var->xres))
return -EINVAL;
}
return 0;
}
EXPORT_SYMBOL_GPL(fbcon_modechange_possible);
static int fbcon_mode_deleted(struct fb_info *info,
struct fb_videomode *mode)
{

20
drivers/video/fbdev/core/fbmem.c
View File

@ -1019,6 +1019,17 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
if (ret)
goto done;
/* verify that virtual resolution >= physical resolution */
if (var->xres_virtual < var->xres ||
var->yres_virtual < var->yres) {
pr_warn("WARNING: fbcon: Driver '%s' missed to adjust virtual screen size (%ux%u vs. %ux%u)\n",
info->fix.id,
var->xres_virtual, var->yres_virtual,
var->xres, var->yres);
ret = -EINVAL;
goto done;
}
if ((var->activate & FB_ACTIVATE_MASK) == FB_ACTIVATE_NOW) {
struct fb_var_screeninfo old_var;
struct fb_videomode mode;
@ -1148,9 +1159,12 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
console_unlock();
return -ENODEV;
}
info->flags |= FBINFO_MISC_USEREVENT;
ret = fb_set_var(info, &var);
info->flags &= ~FBINFO_MISC_USEREVENT;
ret = fbcon_modechange_possible(info, &var);
if (!ret) {
info->flags |= FBINFO_MISC_USEREVENT;
ret = fb_set_var(info, &var);
info->flags &= ~FBINFO_MISC_USEREVENT;
}
unlock_fb_info(info);
console_unlock();
if (!ret && copy_to_user(argp, &var, sizeof(var)))

2
fs/binfmt_elf_fdpic.c
View File

@ -324,7 +324,7 @@ static int load_elf_fdpic_binary(struct linux_binprm *bprm)
else
executable_stack = EXSTACK_DEFAULT;
if (stack_size == 0) {
if (stack_size == 0 && interp_params.flags & ELF_FDPIC_FLAG_PRESENT) {
stack_size = interp_params.stack_size;
if (interp_params.flags & ELF_FDPIC_FLAG_EXEC_STACK)
executable_stack = EXSTACK_ENABLE_X;

216
fs/binfmt_misc.c
View File

@ -58,12 +58,11 @@ typedef struct {
char *name;
struct dentry *dentry;
struct file *interp_file;
refcount_t users; /* sync removal with load_misc_binary() */
} Node;
static DEFINE_RWLOCK(entries_lock);
static struct file_system_type bm_fs_type;
static struct vfsmount *bm_mnt;
static int entry_count;
/*
* Max length of the register string. Determined by:
@ -80,19 +79,23 @@ static int entry_count;
*/
#define MAX_REGISTER_LENGTH 1920
/*
* Check if we support the binfmt
* if we do, return the node, else NULL
* locking is done in load_misc_binary
/**
* search_binfmt_handler - search for a binary handler for @bprm
* @misc: handle to binfmt_misc instance
* @bprm: binary for which we are looking for a handler
*
* Search for a binary type handler for @bprm in the list of registered binary
* type handlers.
*
* Return: binary type list entry on success, NULL on failure
*/
static Node *check_file(struct linux_binprm *bprm)
static Node *search_binfmt_handler(struct linux_binprm *bprm)
{
char *p = strrchr(bprm->interp, '.');
struct list_head *l;
Node *e;
/* Walk all the registered handlers. */
list_for_each(l, &entries) {
Node *e = list_entry(l, Node, list);
list_for_each_entry(e, &entries, list) {
char *s;
int j;
@ -121,9 +124,49 @@ static Node *check_file(struct linux_binprm *bprm)
if (j == e->size)
return e;
}
return NULL;
}
/**
* get_binfmt_handler - try to find a binary type handler
* @misc: handle to binfmt_misc instance
* @bprm: binary for which we are looking for a handler
*
* Try to find a binfmt handler for the binary type. If one is found take a
* reference to protect against removal via bm_{entry,status}_write().
*
* Return: binary type list entry on success, NULL on failure
*/
static Node *get_binfmt_handler(struct linux_binprm *bprm)
{
Node *e;
read_lock(&entries_lock);
e = search_binfmt_handler(bprm);
if (e)
refcount_inc(&e->users);
read_unlock(&entries_lock);
return e;
}
/**
* put_binfmt_handler - put binary handler node
* @e: node to put
*
* Free node syncing with load_misc_binary() and defer final free to
* load_misc_binary() in case it is using the binary type handler we were
* requested to remove.
*/
static void put_binfmt_handler(Node *e)
{
if (refcount_dec_and_test(&e->users)) {
if (e->flags & MISC_FMT_OPEN_FILE)
filp_close(e->interp_file, NULL);
kfree(e);
}
}
/*
* the loader itself
*/
@ -138,12 +181,7 @@ static int load_misc_binary(struct linux_binprm *bprm)
if (!enabled)
return retval;
/* to keep locking time low, we copy the interpreter string */
read_lock(&entries_lock);
fmt = check_file(bprm);
if (fmt)
dget(fmt->dentry);
read_unlock(&entries_lock);
fmt = get_binfmt_handler(bprm);
if (!fmt)
return retval;
@ -237,7 +275,16 @@ static int load_misc_binary(struct linux_binprm *bprm)
goto error;
ret:
dput(fmt->dentry);
/*
* If we actually put the node here all concurrent calls to
* load_misc_binary() will have finished. We also know
* that for the refcount to be zero ->evict_inode() must have removed
* the node to be deleted from the list. All that is left for us is to
* close and free.
*/
put_binfmt_handler(fmt);
return retval;
error:
if (fd_binary > 0)
@ -598,30 +645,90 @@ static struct inode *bm_get_inode(struct super_block *sb, int mode)
return inode;
}
/**
* bm_evict_inode - cleanup data associated with @inode
* @inode: inode to which the data is attached
*
* Cleanup the binary type handler data associated with @inode if a binary type
* entry is removed or the filesystem is unmounted and the super block is
* shutdown.
*
* If the ->evict call was not caused by a super block shutdown but by a write
* to remove the entry or all entries via bm_{entry,status}_write() the entry
* will have already been removed from the list. We keep the list_empty() check
* to make that explicit.
*/
static void bm_evict_inode(struct inode *inode)
{
Node *e = inode->i_private;
if (e && e->flags & MISC_FMT_OPEN_FILE)
filp_close(e->interp_file, NULL);
clear_inode(inode);
kfree(e);
if (e) {
write_lock(&entries_lock);
if (!list_empty(&e->list))
list_del_init(&e->list);
write_unlock(&entries_lock);
put_binfmt_handler(e);
}
}
static void kill_node(Node *e)
/**
* unlink_binfmt_dentry - remove the dentry for the binary type handler
* @dentry: dentry associated with the binary type handler
*
* Do the actual filesystem work to remove a dentry for a registered binary
* type handler. Since binfmt_misc only allows simple files to be created
* directly under the root dentry of the filesystem we ensure that we are
* indeed passed a dentry directly beneath the root dentry, that the inode
* associated with the root dentry is locked, and that it is a regular file we
* are asked to remove.
*/
static void unlink_binfmt_dentry(struct dentry *dentry)
{
struct dentry *dentry;
struct dentry *parent = dentry->d_parent;
struct inode *inode, *parent_inode;
/* All entries are immediate descendants of the root dentry. */
if (WARN_ON_ONCE(dentry->d_sb->s_root != parent))
return;
/* We only expect to be called on regular files. */
inode = d_inode(dentry);
if (WARN_ON_ONCE(!S_ISREG(inode->i_mode)))
return;
/* The parent inode must be locked. */
parent_inode = d_inode(parent);
if (WARN_ON_ONCE(!inode_is_locked(parent_inode)))
return;
if (simple_positive(dentry)) {
dget(dentry);
simple_unlink(parent_inode, dentry);
d_delete(dentry);
dput(dentry);
}
}
/**
* remove_binfmt_handler - remove a binary type handler
* @misc: handle to binfmt_misc instance
* @e: binary type handler to remove
*
* Remove a binary type handler from the list of binary type handlers and
* remove its associated dentry. This is called from
* binfmt_{entry,status}_write(). In the future, we might want to think about
* adding a proper ->unlink() method to binfmt_misc instead of forcing caller's
* to use writes to files in order to delete binary type handlers. But it has
* worked for so long that it's not a pressing issue.
*/
static void remove_binfmt_handler(Node *e)
{
write_lock(&entries_lock);
list_del_init(&e->list);
write_unlock(&entries_lock);
dentry = e->dentry;
drop_nlink(d_inode(dentry));
d_drop(dentry);
dput(dentry);
simple_release_fs(&bm_mnt, &entry_count);
unlink_binfmt_dentry(e->dentry);
}
/* /<entry> */
@ -648,8 +755,8 @@ bm_entry_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
size_t count, loff_t *ppos)
{
struct dentry *root;
Node *e = file_inode(file)->i_private;
struct inode *inode = file_inode(file);
Node *e = inode->i_private;
int res = parse_command(buffer, count);
switch (res) {
@ -663,13 +770,22 @@ static ssize_t bm_entry_write(struct file *file, const char __user *buffer,
break;
case 3:
/* Delete this handler. */
root = file_inode(file)->i_sb->s_root;
inode_lock(d_inode(root));
inode = d_inode(inode->i_sb->s_root);
inode_lock(inode);
/*
* In order to add new element or remove elements from the list
* via bm_{entry,register,status}_write() inode_lock() on the
* root inode must be held.
* The lock is exclusive ensuring that the list can't be
* modified. Only load_misc_binary() can access but does so
* read-only. So we only need to take the write lock when we
* actually remove the entry from the list.
*/
if (!list_empty(&e->list))
kill_node(e);
remove_binfmt_handler(e);
inode_unlock(d_inode(root));
inode_unlock(inode);
break;
default:
return res;
@ -728,13 +844,7 @@ static ssize_t bm_register_write(struct file *file, const char __user *buffer,
if (!inode)
goto out2;
err = simple_pin_fs(&bm_fs_type, &bm_mnt, &entry_count);
if (err) {
iput(inode);
inode = NULL;
goto out2;
}
refcount_set(&e->users, 1);
e->dentry = dget(dentry);
inode->i_private = e;
inode->i_fop = &bm_entry_operations;
@ -778,7 +888,8 @@ static ssize_t bm_status_write(struct file *file, const char __user *buffer,
size_t count, loff_t *ppos)
{
int res = parse_command(buffer, count);
struct dentry *root;
Node *e, *next;
struct inode *inode;
switch (res) {
case 1:
@ -791,13 +902,22 @@ static ssize_t bm_status_write(struct file *file, const char __user *buffer,
break;
case 3:
/* Delete all handlers. */
root = file_inode(file)->i_sb->s_root;
inode_lock(d_inode(root));
inode = d_inode(file_inode(file)->i_sb->s_root);
inode_lock(inode);
while (!list_empty(&entries))
kill_node(list_first_entry(&entries, Node, list));
/*
* In order to add new element or remove elements from the list
* via bm_{entry,register,status}_write() inode_lock() on the
* root inode must be held.
* The lock is exclusive ensuring that the list can't be
* modified. Only load_misc_binary() can access but does so
* read-only. So we only need to take the write lock when we
* actually remove the entry from the list.
*/
list_for_each_entry_safe(e, next, &entries, list)
remove_binfmt_handler(e);
inode_unlock(d_inode(root));
inode_unlock(inode);
break;
default:
return res;

2
fs/btrfs/delayed-inode.c
View File

@ -1018,7 +1018,7 @@ static void btrfs_release_delayed_inode(struct btrfs_delayed_node *delayed_node)
if (delayed_node &&
test_bit(BTRFS_DELAYED_NODE_INODE_DIRTY, &delayed_node->flags)) {
BUG_ON(!delayed_node->root);
ASSERT(delayed_node->root);
clear_bit(BTRFS_DELAYED_NODE_INODE_DIRTY, &delayed_node->flags);
delayed_node->count--;

8
fs/btrfs/free-space-cache.c
View File

@ -1733,9 +1733,9 @@ static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
ctl->free_space -= bytes;
}
static void bitmap_set_bits(struct btrfs_free_space_ctl *ctl,
struct btrfs_free_space *info, u64 offset,
u64 bytes)
static void btrfs_bitmap_set_bits(struct btrfs_free_space_ctl *ctl,
struct btrfs_free_space *info, u64 offset,
u64 bytes)
{
unsigned long start, count;
@ -1992,7 +1992,7 @@ static u64 add_bytes_to_bitmap(struct btrfs_free_space_ctl *ctl,
bytes_to_set = min(end - offset, bytes);
bitmap_set_bits(ctl, info, offset, bytes_to_set);
btrfs_bitmap_set_bits(ctl, info, offset, bytes_to_set);
/*
* We set some bytes, we have no idea what the max extent size is

9
fs/btrfs/ioctl.c
View File

@ -1953,9 +1953,14 @@ static noinline int may_destroy_subvol(struct btrfs_root *root)
key.offset = (u64)-1;
ret = btrfs_search_slot(NULL, fs_info->tree_root, &key, path, 0, 0);
if (ret < 0)
if (ret == 0) {
/*
* Key with offset -1 found, there would have to exist a root
* with such id, but this is out of valid range.
*/
ret = -EUCLEAN;
goto out;
BUG_ON(ret == 0);
}
ret = 0;
if (path->slots[0] > 0) {

2
fs/btrfs/qgroup.c
View File

@ -1952,8 +1952,6 @@ btrfs_qgroup_account_extent(struct btrfs_trans_handle *trans,
if (nr_old_roots == 0 && nr_new_roots == 0)
goto out_free;
BUG_ON(!fs_info->quota_root);
trace_btrfs_qgroup_account_extent(fs_info, bytenr, num_bytes,
nr_old_roots, nr_new_roots);

7
fs/btrfs/send.c
View File

@ -684,7 +684,12 @@ static int begin_cmd(struct send_ctx *sctx, int cmd)
if (WARN_ON(!sctx->send_buf))
return -EINVAL;
BUG_ON(sctx->send_size);
if (unlikely(sctx->send_size != 0)) {
btrfs_err(sctx->send_root->fs_info,
"send: command header buffer not empty cmd %d offset %llu",
cmd, sctx->send_off);
return -EINVAL;
}
sctx->send_size += sizeof(*hdr);
hdr = (struct btrfs_cmd_header *)sctx->send_buf;

3
fs/ext4/extents.c
View File

@ -3450,9 +3450,10 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
struct ext4_extent *ex, *abut_ex;
ext4_lblk_t ee_block, eof_block;
unsigned int ee_len, depth, map_len = map->m_len;
int allocated = 0, max_zeroout = 0;
int err = 0;
int split_flag = EXT4_EXT_DATA_VALID2;
int allocated = 0;
unsigned int max_zeroout = 0;
ext_debug("ext4_ext_convert_to_initialized: inode %lu, logical"
"block %llu, max_blocks %u\n", inode->i_ino,

3
fs/ext4/mballoc.c
View File

@ -5208,6 +5208,9 @@ static int ext4_try_to_trim_range(struct super_block *sb,
void *bitmap;
int ret = 0;
if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)))
return 0;
bitmap = e4b->bd_bitmap;
start = (e4b->bd_info->bb_first_free > start) ?
e4b->bd_info->bb_first_free : start;

2
fs/f2fs/segment.c
View File

@ -2171,6 +2171,8 @@ static void update_sit_entry(struct f2fs_sb_info *sbi, block_t blkaddr, int del)
#endif
segno = GET_SEGNO(sbi, blkaddr);
if (segno == NULL_SEGNO)
return;
se = get_seg_entry(sbi, segno);
new_vblocks = se->valid_blocks + del;

6
fs/fuse/dev.c
View File

@ -1669,9 +1669,11 @@ static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
this_num = min_t(unsigned, num, PAGE_SIZE - offset);
err = fuse_copy_page(cs, &page, offset, this_num, 0);
if (!err && offset == 0 &&
(this_num == PAGE_SIZE || file_size == end))
if (!PageUptodate(page) && !err && offset == 0 &&
(this_num == PAGE_SIZE || file_size == end)) {
zero_user_segment(page, this_num, PAGE_SIZE);
SetPageUptodate(page);
}
unlock_page(page);
put_page(page);

2
fs/gfs2/inode.c
View File

@ -1859,7 +1859,7 @@ static int setattr_chown(struct inode *inode, struct iattr *attr)
kuid_t ouid, nuid;
kgid_t ogid, ngid;
int error;
struct gfs2_alloc_parms ap;
struct gfs2_alloc_parms ap = {};
ouid = inode->i_uid;
ogid = inode->i_gid;

4
fs/locks.c
View File

@ -2324,7 +2324,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
f = fcheck(fd);
spin_unlock(&current->files->file_lock);
if (f != filp) {
locks_remove_posix(filp, &current->files);
locks_remove_posix(filp, current->files);
error = -EBADF;
}
}
@ -2454,7 +2454,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
f = fcheck(fd);
spin_unlock(&current->files->file_lock);
if (f != filp) {
locks_remove_posix(filp, &current->files);
locks_remove_posix(filp, current->files);
error = -EBADF;
}
}

8
fs/nfs/pnfs.c
View File

@ -1736,6 +1736,14 @@ pnfs_update_layout(struct inode *ino,
}
lookup_again:
if (!nfs4_valid_open_stateid(ctx->state)) {
trace_pnfs_update_layout(ino, pos, count,
iomode, lo, lseg,
PNFS_UPDATE_LAYOUT_INVALID_OPEN);
lseg = ERR_PTR(-EIO);
goto out;
}
nfs4_client_recover_expired_lease(clp);
first = false;
spin_lock(&ino->i_lock);

5
fs/quota/dquot.c
View File

@ -905,9 +905,8 @@ we_slept:
* smp_mb__before_atomic() in dquot_acquire().
*/
smp_rmb();
#ifdef CONFIG_QUOTA_DEBUG
BUG_ON(!dquot->dq_sb); /* Has somebody invalidated entry under us? */
#endif
/* Has somebody invalidated entry under us? */
WARN_ON_ONCE(hlist_unhashed(&dquot->dq_hash));
out:
if (empty)
do_destroy_dquot(empty);

2
include/linux/blkdev.h
View File

@ -59,7 +59,7 @@ struct keyslot_manager;
*/
#define BLKCG_MAX_POLS 3
static inline int blk_validate_block_size(unsigned int bsize)
static inline int blk_validate_block_size(unsigned long bsize)
{
if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
return -EINVAL;

4
include/linux/fbcon.h
View File

@ -4,9 +4,13 @@
#ifdef CONFIG_FRAMEBUFFER_CONSOLE
void __init fb_console_init(void);
void __exit fb_console_exit(void);
int fbcon_modechange_possible(struct fb_info *info,
struct fb_var_screeninfo *var);
#else
static inline void fb_console_init(void) {}
static inline void fb_console_exit(void) {}
static inline int fbcon_modechange_possible(struct fb_info *info,
struct fb_var_screeninfo *var) { return 0; }
#endif
#endif /* _LINUX_FBCON_H */

133
include/linux/overflow.h
View File

@ -234,6 +234,69 @@
(*_d >> _to_shift) != _a); \
})
/**
* size_mul() - Calculate size_t multiplication with saturation at SIZE_MAX
*
* @factor1: first factor
* @factor2: second factor
*
* Returns: calculate @factor1 * @factor2, both promoted to size_t,
* with any overflow causing the return value to be SIZE_MAX. The
* lvalue must be size_t to avoid implicit type conversion.
*/
static inline size_t __must_check size_mul(size_t factor1, size_t factor2)
{
size_t bytes;
if (check_mul_overflow(factor1, factor2, &bytes))
return SIZE_MAX;
return bytes;
}
/**
* size_add() - Calculate size_t addition with saturation at SIZE_MAX
*
* @addend1: first addend
* @addend2: second addend
*
* Returns: calculate @addend1 + @addend2, both promoted to size_t,
* with any overflow causing the return value to be SIZE_MAX. The
* lvalue must be size_t to avoid implicit type conversion.
*/
static inline size_t __must_check size_add(size_t addend1, size_t addend2)
{
size_t bytes;
if (check_add_overflow(addend1, addend2, &bytes))
return SIZE_MAX;
return bytes;
}
/**
* size_sub() - Calculate size_t subtraction with saturation at SIZE_MAX
*
* @minuend: value to subtract from
* @subtrahend: value to subtract from @minuend
*
* Returns: calculate @minuend - @subtrahend, both promoted to size_t,
* with any overflow causing the return value to be SIZE_MAX. For
* composition with the size_add() and size_mul() helpers, neither
* argument may be SIZE_MAX (or the result with be forced to SIZE_MAX).
* The lvalue must be size_t to avoid implicit type conversion.
*/
static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)
{
size_t bytes;
if (minuend == SIZE_MAX || subtrahend == SIZE_MAX ||
check_sub_overflow(minuend, subtrahend, &bytes))
return SIZE_MAX;
return bytes;
}
/**
* array_size() - Calculate size of 2-dimensional array.
*
@ -245,15 +308,7 @@
* Returns: number of bytes needed to represent the array or SIZE_MAX on
* overflow.
*/
static inline __must_check size_t array_size(size_t a, size_t b)
{
size_t bytes;
if (check_mul_overflow(a, b, &bytes))
return SIZE_MAX;
return bytes;
}
#define array_size(a, b) size_mul(a, b)
/**
* array3_size() - Calculate size of 3-dimensional array.
@ -267,44 +322,38 @@ static inline __must_check size_t array_size(size_t a, size_t b)
* Returns: number of bytes needed to represent the array or SIZE_MAX on
* overflow.
*/
static inline __must_check size_t array3_size(size_t a, size_t b, size_t c)
{
size_t bytes;
if (check_mul_overflow(a, b, &bytes))
return SIZE_MAX;
if (check_mul_overflow(bytes, c, &bytes))
return SIZE_MAX;
return bytes;
}
static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c)
{
size_t bytes;
if (check_mul_overflow(n, size, &bytes))
return SIZE_MAX;
if (check_add_overflow(bytes, c, &bytes))
return SIZE_MAX;
return bytes;
}
#define array3_size(a, b, c) size_mul(size_mul(a, b), c)
/**
* struct_size() - Calculate size of structure with trailing array.
* @p: Pointer to the structure.
* @member: Name of the array member.
* @n: Number of elements in the array.
* flex_array_size() - Calculate size of a flexible array member
* within an enclosing structure.
*
* Calculates size of memory needed for structure @p followed by an
* array of @n @member elements.
* @p: Pointer to the structure.
* @member: Name of the flexible array member.
* @count: Number of elements in the array.
*
* Calculates size of a flexible array of @count number of @member
* elements, at the end of structure @p.
*
* Return: number of bytes needed or SIZE_MAX on overflow.
*/
#define struct_size(p, member, n) \
__ab_c_size(n, \
sizeof(*(p)->member) + __must_be_array((p)->member),\
sizeof(*(p)))
#define flex_array_size(p, member, count) \
size_mul(count, \
sizeof(*(p)->member) + __must_be_array((p)->member))
/**
* struct_size() - Calculate size of structure with trailing flexible array.
*
* @p: Pointer to the structure.
* @member: Name of the array member.
* @count: Number of elements in the array.
*
* Calculates size of memory needed for structure @p followed by an
* array of @count number of @member elements.
*
* Return: number of bytes needed or SIZE_MAX on overflow.
*/
#define struct_size(p, member, count) \
size_add(sizeof(*(p)), flex_array_size(p, member, count))
#endif /* __LINUX_OVERFLOW_H */

2
include/net/busy_poll.h
View File

@ -73,7 +73,7 @@ static inline bool sk_can_busy_loop(struct sock *sk)
static inline unsigned long busy_loop_current_time(void)
{
#ifdef CONFIG_NET_RX_BUSY_POLL
return (unsigned long)(local_clock() >> 10);
return (unsigned long)(ktime_get_ns() >> 10);
#else
return 0;
#endif

1
include/net/kcm.h
View File

@ -73,6 +73,7 @@ struct kcm_sock {
struct work_struct tx_work;
struct list_head wait_psock_list;
struct sk_buff *seq_skb;
struct mutex tx_mutex;
u32 tx_stopped : 1;
/* Don't use bit fields here, these are set under different locks */

2
ipc/msg.c
View File

@ -119,7 +119,7 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
key_t key = params->key;
int msgflg = params->flg;
msq = kvmalloc(sizeof(*msq), GFP_KERNEL);
msq = kvmalloc(sizeof(*msq), GFP_KERNEL_ACCOUNT);
if (unlikely(!msq))
return -ENOMEM;

7
ipc/sem.c
View File

@ -457,7 +457,7 @@ static struct sem_array *sem_alloc(size_t nsems)
return NULL;
size = sizeof(*sma) + nsems * sizeof(sma->sems[0]);
sma = kvmalloc(size, GFP_KERNEL);
sma = kvmalloc(size, GFP_KERNEL_ACCOUNT);
if (unlikely(!sma))
return NULL;
@ -1727,7 +1727,7 @@ static inline int get_undo_list(struct sem_undo_list **undo_listp)
undo_list = current->sysvsem.undo_list;
if (!undo_list) {
undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL);
undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL_ACCOUNT);
if (undo_list == NULL)
return -ENOMEM;
spin_lock_init(&undo_list->lock);
@ -1811,7 +1811,8 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
rcu_read_unlock();
/* step 2: allocate new undo structure */
new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems,
GFP_KERNEL_ACCOUNT);
if (!new) {
ipc_rcu_putref(&sma->sem_perm, sem_rcu_free);
return ERR_PTR(-ENOMEM);

2
ipc/shm.c
View File

@ -648,7 +648,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
ns->shm_tot + numpages > ns->shm_ctlall)
return -ENOSPC;
shp = kvmalloc(sizeof(*shp), GFP_KERNEL);
shp = kvmalloc(sizeof(*shp), GFP_KERNEL_ACCOUNT);
if (unlikely(!shp))
return -ENOMEM;

13
kernel/cgroup/cpuset.c
View File

@ -22,6 +22,7 @@
* distribution for more details.
*/
#include "cgroup-internal.h"
#include <linux/cpu.h>
#include <linux/cpumask.h>
#include <linux/cpuset.h>
@ -2785,10 +2786,14 @@ int proc_cpuset_show(struct seq_file *m, struct pid_namespace *ns,
if (!buf)
goto out;
css = task_get_css(tsk, cpuset_cgrp_id);
retval = cgroup_path_ns(css->cgroup, buf, PATH_MAX,
current->nsproxy->cgroup_ns);
css_put(css);
rcu_read_lock();
spin_lock_irq(&css_set_lock);
css = task_css(tsk, cpuset_cgrp_id);
retval = cgroup_path_ns_locked(css->cgroup, buf, PATH_MAX,
current->nsproxy->cgroup_ns);
spin_unlock_irq(&css_set_lock);
rcu_read_unlock();
if (retval >= PATH_MAX)
retval = -ENAMETOOLONG;
if (retval < 0)

1
kernel/printk/printk.c
View File

@ -2278,6 +2278,7 @@ int is_console_locked(void)
{
return console_locked;
}
EXPORT_SYMBOL(is_console_locked);
/*
* Check if we have any console that is capable of printing while cpu is

4
kernel/sched/fair.c
View File

@ -12246,8 +12246,8 @@ static void nohz_idle_balance(struct rq *this_rq, enum cpu_idle_type idle)
cpumask_andnot(&cpus, nohz.idle_cpus_mask, cpu_isolated_mask);
for_each_cpu(balance_cpu, nohz.idle_cpus_mask) {
if (!idle_cpu(balance_cpu))
for_each_cpu(balance_cpu, &cpus) {
if (balance_cpu == this_cpu || !idle_cpu(balance_cpu))
continue;
/*

3
kernel/time/hrtimer.c
View File

@ -1158,6 +1158,9 @@ void hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
struct hrtimer_clock_base *base;
unsigned long flags;
if (WARN_ON_ONCE(!timer->function))
return;
/*
* Check whether the HRTIMER_MODE_SOFT bit and hrtimer.is_soft
* match on CONFIG_PREEMPT_RT = n. With PREEMPT_RT check the hard

2
lib/idr.c
View File

@ -428,7 +428,7 @@ void ida_remove(struct ida *ida, int id)
} else {
btmp = bitmap->bitmap;
}
if (!test_bit(offset, btmp))
if (!bitmap || !test_bit(offset, btmp))
goto err;
__clear_bit(offset, btmp);

7
mm/memcontrol.c
View File

@ -3946,9 +3946,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
buf = endp + 1;
cfd = simple_strtoul(buf, &endp, 10);
if ((*endp != ' ') && (*endp != '\0'))
if (*endp == '\0')
buf = endp;
else if (*endp == ' ')
buf = endp + 1;
else
return -EINVAL;
buf = endp + 1;
event = kzalloc(sizeof(*event), GFP_KERNEL);
if (!event)

3
net/bluetooth/bnep/core.c
View File

@ -385,7 +385,8 @@ static int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
case BNEP_COMPRESSED_DST_ONLY:
__skb_put_data(nskb, skb_mac_header(skb), ETH_ALEN);
__skb_put_data(nskb, s->eh.h_source, ETH_ALEN + 2);
__skb_put_data(nskb, s->eh.h_source, ETH_ALEN);
put_unaligned(s->eh.h_proto, (__be16 *)__skb_put(nskb, 2));
break;
case BNEP_GENERAL:

58
net/bluetooth/hci_core.c
View File

@ -3819,15 +3819,27 @@ static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
}
static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
{
if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
/* ACL tx timeout must be longer than maximum
* link supervision timeout (40.9 seconds) */
if (!cnt && time_after(jiffies, hdev->acl_last_tx +
HCI_ACL_TX_TIMEOUT))
hci_link_tx_to(hdev, ACL_LINK);
unsigned long last_tx;
if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
return;
switch (type) {
case LE_LINK:
last_tx = hdev->le_last_tx;
break;
default:
last_tx = hdev->acl_last_tx;
break;
}
/* tx timeout must be longer than maximum link supervision timeout
* (40.9 seconds)
*/
if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT))
hci_link_tx_to(hdev, type);
}
static void hci_sched_acl_pkt(struct hci_dev *hdev)
@ -3837,7 +3849,7 @@ static void hci_sched_acl_pkt(struct hci_dev *hdev)
struct sk_buff *skb;
int quote;
__check_timeout(hdev, cnt);
__check_timeout(hdev, cnt, ACL_LINK);
while (hdev->acl_cnt &&
(chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
@ -3876,8 +3888,6 @@ static void hci_sched_acl_blk(struct hci_dev *hdev)
int quote;
u8 type;
__check_timeout(hdev, cnt);
BT_DBG("%s", hdev->name);
if (hdev->dev_type == HCI_AMP)
@ -3885,6 +3895,8 @@ static void hci_sched_acl_blk(struct hci_dev *hdev)
else
type = ACL_LINK;
__check_timeout(hdev, cnt, type);
while (hdev->block_cnt > 0 &&
(chan = hci_chan_sent(hdev, type, &quote))) {
u32 priority = (skb_peek(&chan->data_q))->priority;
@ -3997,24 +4009,19 @@ static void hci_sched_le(struct hci_dev *hdev)
{
struct hci_chan *chan;
struct sk_buff *skb;
int quote, cnt, tmp;
int quote, *cnt, tmp;
BT_DBG("%s", hdev->name);
if (!hci_conn_num(hdev, LE_LINK))
return;
if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
/* LE tx timeout must be longer than maximum
* link supervision timeout (40.9 seconds) */
if (!hdev->le_cnt && hdev->le_pkts &&
time_after(jiffies, hdev->le_last_tx + HZ * 45))
hci_link_tx_to(hdev, LE_LINK);
}
cnt = hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
tmp = cnt;
while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
__check_timeout(hdev, *cnt, LE_LINK);
tmp = *cnt;
while (*cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
u32 priority = (skb_peek(&chan->data_q))->priority;
while (quote-- && (skb = skb_peek(&chan->data_q))) {
BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
@ -4029,18 +4036,13 @@ static void hci_sched_le(struct hci_dev *hdev)
hci_send_frame(hdev, skb);
hdev->le_last_tx = jiffies;
cnt--;
(*cnt)--;
chan->sent++;
chan->conn->sent++;
}
}
if (hdev->le_pkts)
hdev->le_cnt = cnt;
else
hdev->acl_cnt = cnt;
if (cnt != tmp)
if (*cnt != tmp)
hci_prio_recalculate(hdev, LE_LINK);
}

4
net/bluetooth/mgmt.c
View File

@ -2777,6 +2777,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
* will be kept and this function does nothing.
*/
p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
if (!p) {
err = -EIO;
goto unlock;
}
if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
p->auto_connect = HCI_AUTO_CONN_DISABLED;

3
net/core/skbuff.c
View File

@ -3624,8 +3624,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
/* GSO partial only requires that we trim off any excess that
* doesn't fit into an MSS sized block, so take care of that
* now.
* Cap len to not accidentally hit GSO_BY_FRAGS.
*/
partial_segs = len / mss;
partial_segs = min(len, (unsigned int)(GSO_BY_FRAGS - 1)) / mss;
if (partial_segs > 1)
mss *= partial_segs;
else

2
net/ipv6/ip6_output.c
View File

@ -1754,6 +1754,7 @@ int ip6_send_skb(struct sk_buff *skb)
struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
int err;
rcu_read_lock();
err = ip6_local_out(net, skb->sk, skb);
if (err) {
if (err > 0)
@ -1763,6 +1764,7 @@ int ip6_send_skb(struct sk_buff *skb)
IPSTATS_MIB_OUTDISCARDS);
}
rcu_read_unlock();
return err;
}

3
net/iucv/iucv.c
View File

@ -1149,8 +1149,7 @@ static int iucv_message_receive_iprmdata(struct iucv_path *path,
size = (size < 8) ? size : 8;
for (array = buffer; size > 0; array++) {
copy = min_t(size_t, size, array->length);
memcpy((u8 *)(addr_t) array->address,
rmmsg, copy);
memcpy(phys_to_virt(array->address), rmmsg, copy);
rmmsg += copy;
size -= copy;
}

4
net/kcm/kcmsock.c
View File

@ -912,6 +912,7 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
!(msg->msg_flags & MSG_MORE) : !!(msg->msg_flags & MSG_EOR);
int err = -EPIPE;
mutex_lock(&kcm->tx_mutex);
lock_sock(sk);
/* Per tcp_sendmsg this should be in poll */
@ -1060,6 +1061,7 @@ partial_message:
KCM_STATS_ADD(kcm->stats.tx_bytes, copied);
release_sock(sk);
mutex_unlock(&kcm->tx_mutex);
return copied;
out_error:
@ -1085,6 +1087,7 @@ out_error:
sk->sk_write_space(sk);
release_sock(sk);
mutex_unlock(&kcm->tx_mutex);
return err;
}
@ -1327,6 +1330,7 @@ static void init_kcm_sock(struct kcm_sock *kcm, struct kcm_mux *mux)
spin_unlock_bh(&mux->lock);
INIT_WORK(&kcm->tx_work, kcm_tx_work);
mutex_init(&kcm->tx_mutex);
spin_lock_bh(&mux->rx_lock);
kcm_rcv_ready(kcm);

5
net/netfilter/nft_counter.c
View File

@ -107,11 +107,16 @@ static void nft_counter_reset(struct nft_counter_percpu_priv __percpu *priv,
struct nft_counter *total)
{
struct nft_counter *this_cpu;
seqcount_t *myseq;
local_bh_disable();
this_cpu = this_cpu_ptr(priv->counter);
myseq = this_cpu_ptr(&nft_counter_seq);
write_seqcount_begin(myseq);
this_cpu->packets -= total->packets;
this_cpu->bytes -= total->bytes;
write_seqcount_end(myseq);
local_bh_enable();
}

13
net/rds/recv.c
View File

@ -427,6 +427,7 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
struct sock *sk = rds_rs_to_sk(rs);
int ret = 0;
unsigned long flags;
struct rds_incoming *to_drop = NULL;
write_lock_irqsave(&rs->rs_recv_lock, flags);
if (!list_empty(&inc->i_item)) {
@ -437,11 +438,14 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
-be32_to_cpu(inc->i_hdr.h_len),
inc->i_hdr.h_dport);
list_del_init(&inc->i_item);
rds_inc_put(inc);
to_drop = inc;
}
}
write_unlock_irqrestore(&rs->rs_recv_lock, flags);
if (to_drop)
rds_inc_put(to_drop);
rdsdebug("inc %p rs %p still %d dropped %d\n", inc, rs, ret, drop);
return ret;
}
@ -695,16 +699,21 @@ void rds_clear_recv_queue(struct rds_sock *rs)
struct sock *sk = rds_rs_to_sk(rs);
struct rds_incoming *inc, *tmp;
unsigned long flags;
LIST_HEAD(to_drop);
write_lock_irqsave(&rs->rs_recv_lock, flags);
list_for_each_entry_safe(inc, tmp, &rs->rs_recv_queue, i_item) {
rds_recv_rcvbuf_delta(rs, sk, inc->i_conn->c_lcong,
-be32_to_cpu(inc->i_hdr.h_len),
inc->i_hdr.h_dport);
list_move(&inc->i_item, &to_drop);
}
write_unlock_irqrestore(&rs->rs_recv_lock, flags);
list_for_each_entry_safe(inc, tmp, &to_drop, i_item) {
list_del_init(&inc->i_item);
rds_inc_put(inc);
}
write_unlock_irqrestore(&rs->rs_recv_lock, flags);
}
/*

2
security/selinux/avc.c
View File

@ -401,12 +401,12 @@ static int avc_add_xperms_decision(struct avc_node *node,
{
struct avc_xperms_decision_node *dest_xpd;
node->ae.xp_node->xp.len++;
dest_xpd = avc_xperms_decision_alloc(src->used);
if (!dest_xpd)
return -ENOMEM;
avc_copy_xperms_decision(&dest_xpd->xpd, src);
list_add(&dest_xpd->xpd_list, &node->ae.xp_node->xpd_head);
node->ae.xp_node->xp.len++;
return 0;
}

2
sound/core/timer.c
View File

@ -527,7 +527,7 @@ static int snd_timer_start1(struct snd_timer_instance *timeri,
/* check the actual time for the start tick;
* bail out as error if it's way too low (< 100us)
*/
if (start) {
if (start && !(timer->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
if ((u64)snd_timer_hw_resolution(timer) * ticks < 100000) {
result = -EINVAL;
goto unlock;

1
sound/usb/quirks-table.h
View File

@ -332,6 +332,7 @@ YAMAHA_DEVICE(0x105a, NULL),
YAMAHA_DEVICE(0x105b, NULL),
YAMAHA_DEVICE(0x105c, NULL),
YAMAHA_DEVICE(0x105d, NULL),
YAMAHA_DEVICE(0x1718, "P-125"),
{
USB_DEVICE(0x0499, 0x1503),
.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {